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FOREWORD 


This report is a design survey of the Lunar Orbiter Guidance and Control 
system and is one in a series of design surveys prepared for the NASA 
Design Criteria Program. The objective of this NASA program is to estab- 
lish a unification of design approaches in the development of space 
vehicles and their major components. The surveys are intended to document 
design experience gained from specific NASA projects and will be used as 
a data source for design criteria monograph documents. 

This design survey was performed in accordance with the Statement of Work 
in NASA contract NAS 12-2027, "Lunar Orbiter Design Criteria Survey," for 
the NASA Electronics Research Center Design Criteria Office, directed 
by Mr. Frank J. Carroll, Jr. 

The material for this report was gathered, prepared, and documented under 
the direction of the Program Manager, J. E. Montgomery. Major sections 
of the report were contributed by Messrs. D. C. Fosth, E. W. Kangas, 

R. L. Maxwell, W. I, Mitchell, G. E. Morrison, G. A. Price, R. E. Risdal 
and W. F. Xee. Mr. V. L. Minter assisted in compiling and editing the 
final manuscript as well as writing portions of the report. Numerous 
other Lunar Orbiter team members who participated in the design, develop- 
ment, and operation contributed much needed assistance, consultation, and 
review. 

The report is organized in the following manner: 

Summary - briefly states the most important items from this design 
survey. 

Introduction - describes the overall Lunar Orbiter program; the 
successes and failures; the spacecraft and the guidance and control 
system. 

Subsystems - are described, requirements listed, development and 
operation are discussed in detail, conclusions and recommendations 
are given. 

Components - are treated in a manner similar to the subsystems but 
to a finer level of detail. 

Bibliography - lists a selection of significant references for those 
who "want to dig deeper." 

The contractor's designation for this report is D2-114277-2. 
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1.0 SUMMARY 

This design survey presents the results of an eight month study of the 
Lunar Orbiter Guidance and Control System and program documentation. High- 
lights of the experiences gained from program initiation through the final 
terminal crash maneuver of L.O. V are reported. The things of value to the 
designer of future spacecraft are emphasized. The evolution of the design 
was studied and the reasons for changes have been indicated. Considerable 
effort was made to identify and report the cause for difficulties that 
occurred. Reasons for success as well as failure are summarized in the 
following paragraphs beginning with the total spacecraft program; proceeding 
to an in-depth review of the guidance and control system, its subsystems, 
and finally the G&C components. 

PROGRAM FEATURES 


The items which had a major impact on the overall program were the following: 

1) Basic program objectives remained unchanged throughout the design and 
operational flight phases. 

2) The test concept was that the initial flight would be a complete 
operational mission. Every flight spacecraft was subjected to a 
"Plight Acceptance Test" which simulated the nominal operation 
environment for temperature, vacuum and vibration. Every compo- 
nent was subjected to prior tests which eliminated serious problems 
at the spacecraft level. 

3) Technical reviews among the contractors and government agencies were 
held throughout the program beginning with engineering information 
exchanges, preliminary design reviews, critical design reviews, space- 
craft compliance reviews, and culminating in a Plight Readiness review 
which involved all the companies and agencies concerned with the 
launch. It was most significant that the standard of conduct for these 
reviews was "What was right rather than who was right." 

4) A strong team concept with close working relationships was maintained 
among customer and contractor personnel. Test teams were assigned to 
particular spacecraft at final assembly, and continued through test, 
planned launch, and flight operations. The continuity of personnel 
from design through flight operation was important. 

5) Space proven hardware and techniques were used wherever possible. 

6) The incentive features of the contract covering delivery, cost, and 
performance motivated the contractor and the government to fulfill 
their side of the contractual interface in a timely manner. 

GUIDANCE AND CONTROL SYSTEM 


Guidance and Control System concepts which contributed to the success were: 
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1') "Put the intelligence on the ground," was a guiding criterion when 
choosing between competitive designs. This led to a simple system 
implementation . 

2) Complementary paths of information via the engineering telemetry gave a 

comprehensive picture of spacecraft status and performance. Alternate 
modes of operation allowed the flight operations crew to exploit the re- 
maining spacecraft capability. Examples were: the use of the high gain 

antenna signal strength map to corroborate the questionable roll infor- 
mation from the star tracker; the use -of the solar panel array current 
and voltage as a measure of the angle off the sun for angles exceeding 
the sun sensor saturation level. 

3 ) Operational flexibility was provided. For example, the mission could be 
controlled from either stored programs or real time commands. 

4 ) A three axis stabilized configuration was selected which best suited the 
mission requirements. The technology was developed by the let Propulsion 
Laboratory for interplanetary spacecraft. 

ATTITUDE CONTROL SUBSYSTEM 


The most significant features of the design are summarized in* the following: 

1) The attitude control performance actually experienced was close to that 

predicted for each of the following items: deadzone width, limit cycle 

rate, maneuver rate, settling time, accuracy, effect of disturbance 
torque, and impulse requirements. 

2) The- options available in attitude control provided the work arounds 
which salvaged the missions. The options were: 

a) To hold attitude using error signals from the Sun and Canopus sen- 
sors or using the gyros in the rate integrate mode. This gave an 
inertially referenced attitude when the Canopus tracker gave trouble. 

b) To select wide or narrow reaction control threshold deadzones. This 
gave 2° or .2° limit cycle, also .05°/sec or .5°/sec maneuver slew 
rates; the former conserved reaction control gas. 

c) To select coarse or fine sun sensors. This gave a wide angle refer- 
ence and an additional deadzone option. It was used to conserve gas 
when re-acquiring the sun. 

d) To switch the Canopus tracker off and on without necessarily using 
the error signal for attitude control. This technique was used 
often to track Canopus instead of glint, also to allow the image 
dissector tube to "heal” after being exposed to excessive light 
flux. 
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REACTION CONTROL 


The cold gas Nitrogen reaction control subsystem operated reliably on all 

flights, with a delivered specific impulse of at least 68 seconds, and 'with 

leakage less than .5 lb of gas per year. The most important design features 

were : 

1) The brazed and welded construction prevented leakage. 

2) The cleanliness requirements, i.e., no metallic particles larger than 
5 microns, nor non-metallic greater than 25 microns were allowed, 
prevented contamination from becoming a problem causing leakage or 

'jamming. Filters provided a redundancy to the cleanliness provisions. 

3) The common N 2 supply for the Reaction and Velocity control subsystems 
provided an adequate gas supply. 

THRUST VECTOR CONTROL SUBSYSTEM 

The most significant design features of the thrust vector control were: 

1) Electromechanical position servo actuators were developed to gimbal 
the engine. This control concept was adopted 4 months after contract 
go-ahead. The one pound thrust reaction control jets on the tips of 
the solar panels ware deleted; 

2) Dynamic stability of design provided a 6 db gain margin based on a 
worst case combination of conditions. The large center of mass changes 
postulated for propellant migration between paired tanks did not occurs 
thus, flight performance did not approach design limits. 

3) Dual lead-lag compensation networks on gyro position error signal made 
the system susceptible to mechanical and electrical noise. Problems 
were solved by filtering high frequency noise and setting limits on 
allowable gyro noise. 

VELOCITY CONTROL SUBSYSTEM 


The velocity control subsystem functioned as intended on all flights. An" 
error analysis provided the basis for permitting the use of existing hardware. 

GUIDANCE CONCEPT 


The most important feature of the guidance concept was the use of ground 
based intelligence, skill and facilities in determining the spacecraft state 
vector, computing required maneuvers, commanding their execution, deter- 
mining the new state and adjusting the subsequent planned events tobest 
accommodate the mission objectives. The major error found in locating photo 
sites was the uncertainty in the lunar gravitational model. 
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INERTIAL REFERENCE UNIT 


The Lunar Orbiter IRU provided a 3 axis attitude reference and integrating 
accelerometer in a unit weighing 13.4 lb. and requiring less than 30 watts. 
Gyro drift was in the range of l/2° per hour. Once committed to launch no 
life, wear-out, or reliability problems occurred on missions up to a year in 
length. 

The principal problems were the result of: 

1) Unrealistic severe vibration requirements were originally specified and 
relaxed late in the qualification program. 

2) The Sperry SYG 1000 gyro was not being produced in quantity. The low 
yield of acceptable gyros made it necessary to obtain a second source of 
gyros. 

The back-up program using the Kearfott alpha gyros in the Sperry frame and 
electronics was successful^ 

SUN SENSORS 


The Sun Sensors used an arrangement of cells tailored to the Lunar Orbiter 
configuration to give complete spherical coverage. The sensor elements were 
the same as those used on the O.S.O. spacecraft built by Ball Brothers. To 
avoid introducing pointing errors from the nearby illuminated moon required 
the wide field of view cells to be switched out. The problem' most affecting 
delivery and test schedules was caused by weather and cloud conditions at 
Boulder, Colorado since the actual sun was used for calibration and test. 

CANOPUS STAR TRACKER. 


The Canopus star tracker was consistently hampered by "glint" from illuminated 
spacecraft- appendages, from earthlight, moonlight, and direct s unligh t. Causes 
of the trouble were the sensitivity of the tracker to stray light coupled with 
the arrangement of the tracker field of view and the spacecraft appendages. 

PLIGHT ELECTRONICS CONTROL ASSEMBLY 


This unit was specifically designed to the requirements of the Lunar Orbiter 
spacecraft and mission. It provided timing, sequencing and control of all 
spacecraft events from either stored program or real time commands. It also 
provided the electronics for closing the control loops around the reaction 
and thrust vector control subsystems. 

The criteria most emphasized in the design were: 

a) High reliability - affected the choice of parts, processes, and circuit 
techniques. The design was essentially single thread, but with redundant 
clock oscillators. 

b) Low power - driver circuits were designed to be in the off state during 
quiescent periods. 
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c) Low weight - integrated circuits were selected for the programmer even 
though the reliability of mass produced articles in 1964 was not yet 
firmly established. 

d) Resistance to electromagnetic interference - voltage margin for digital 
logic state switching was required for worst case design conditions of 
temperature and voltage. 

Unexpected design and manufacturing problems which were solved during the 
program were: difficulty in obtaining approved parts, static discharge causing 

micrologic module failures, contamination of one lot of micrologic modules, 
stress from the potting process causing electrical value change, cross talk 
between the redundant clocks causing extra bits in the time words. 

THRUST VECTOR CONTROL ACTUATOR 


This unit was a hermetically sealed servo using a d-c motor and solid state 
electronics. It was developed specifically for this application. The short 
design and development time allowed before first article delivery pushed the 
bulk of the servo de-bugging problems into the acceptance and qualification 
phases of the program. With hindsight one can say the specified requirements 
for 10°/sec rate, for +2.9° stroke, and for irreversibility during launch 
were somewhat conservative. 

RECOMMENDATIONS FOR DOING DIFFERENTLY 

The important items which should be done differently on future spacecraft are: 

1. The mission system and component requirements analysis should be done 
before specifications are sent to vendors and designs are firm. It is 
important that both performance and environment be realistic. 


2. The Star tracker optical, mechanical, and electronic analysis and design 
should be checked in detdil before proceeding with construction. Test 
methods and facilities to evaluate component and spacecraft glint should 
be developed. 

3- Inertial instruments for an IRU should be selected from a mature design to 
avoid extensive development problems. The marks of maturity for gyros 
are to be in quantity production on the same article, to have service 
experience, and to have service recorded for failure analysis. Any change, 
even of the float fluid, should be considered a major design departure. 

4. The ability to command one spacecraft only when two or more are present 
should be assured: preferably by assigning different radio link fre- 

quencies to each. 

5- Operational procedures developed to solve emergency situations should not 
be continued on subsequent missions j for example, flying off-sun for 
thermal relief, or continuing flights with the Canopus tracker glint 
problem unresolved. 
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2.0 INTRODUCTION 

The Lunar Orbiter program was directed by NASA' s Office of Space Science 
and Applications, and managed by the agency's Langley Research Center. 
Contract award was made to The Boeing Company in March 1964 , and the first 
mission occurred on August 10, 1966. The primary objective of the Lunar 
Orbiter spacecraft was to obtain high resolution photographic data of speci- 
fic lunar areas to aid in the selection of Apollo landing sites. Secondary 
objectives were, .to obtain data about the size, shape, and gravitational 
field of the Moon; the micrometeroid and radiation levels in the lunar 
environment; and moderate resolution photography of extensive areas. How- 
ever, it was not required that all objectives be satisfied on any one mis- 
sion. Specific mission plans were not identified until shortly before each 
spacecraft flew. This resulted in a broad range of hardware capability 
being designed into the spacecraft. It provided the flexibility to plan 
specific missions around this design capability and to take advantage of 
results from previous flights. This flexibility also provided the capabi- 
lity to utilize backup modes and work-around methods to accommodate in- 
flight anomalies. 

A typical mission is illustrated in Figure 2-1. The flight profile events 
are illustrated in Figure 2-2 and described in the following. The space- 
craft and Atlas/Agena launch vehicle underwent countdown as one functional 
unit, called the Lunar Orbiter space vehicle. At the completion of count- 
down the Atlas boosted the space vehicle to an altitude of 85 miles before 
Atlas separation. The spacecraft nose shroud, no longer required for atmos- 
pheric protection, was jettisoned prior to Agena firing. The Agena acceler- 
ated the Agena/Orbiter combination into a 100-mile-altitude parking orbit. 
After coasting to the translunar injection point, the Agena engine was re- 
ignited and accelerated the spacecraft to escape velocity. The Lunar Orbiter 
was then separated and began its coast to the Moon. 


After spacecraft separation, signals from the flight electronics control 
assembly initiated squib firing to deploy solar panels, antenna booms, and 
to activate the reaction control subsystem. Sun sensors and rate gyros 
controlled the opening of small nitrogen thrusters, causing the spacecraft 
to pitch and yaw until the correct sun attitude was attained. The roll 
rate was reduced to near zero by another set of thrusters. At a later time, 
the spacecraft performed a series of roll maneuvers to enable the star 
tracker to acquire Canopus. This completed the initial three axis orienta- 
tion and stabilization of the spacecraft. 

Continued tracking by the deep space stations enabled the Space Flight 
Operations Facility to compute spacecraft range, velocity, and flight path. 
Deviation from the intended trajectory was corrected by transmitting the 
necessary guidance commands to the spacecraft flight electronics control 
assembly, where they were stored and subsequently executed. At the proper 
time the spacecraft broke the sun/star reference attitude and oriented the 
spacecraft to point the rocket engine in the desired direction. Attitude 
reference was then provided by the inertial reference unit. The 100-pound 
thrust engine was ignited, changing the spacecraft velocity vector until 
the integrated output of accelerometer measuring the velocity change, shut 
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off the engine. The spacecraft systems were designed to perform a second 
midcourse correction if required. However, none of the five missions re- 
quired a second correction. 

Trajectory data obtained throughout the translunar flight was used by the 
Space Flight Operations Facility to compute the velocity and direction 
changes required to achieve initial lunar orbit. The necessary commands 
were again transmitted to the flight electronics control assembly. At the 
proper time the spacecraft was injected into Lunar Orbit. Additional 
tracking of the spacecraft by the deep space stations accurately established 
the actual orbit and subsequent orbit changes were accomplished as required 
by the mission. 

The photographic phase of the mission required a precise knowledge of the 
orientation and position of the spacecraft to point the camera at the de- 
sired target area. The desired spacecraft maneuvers from the sun/star 
reference attitude were determined at the Space Flight Operation Facility 
from tracking data. Commands were transmitted to the flight electronics - 
control assembly for execution at the proper time. The flexibility of the 
photographic subsystem, coupled with the ability to design the mission for 
a range of orbit parameters such as inclination and perilune altitude pro- 
vided great flexibility in selecting the size, shape, and location of the 
areas to be photographed. 

MISSION PERFORMANCE 


The mission results are summarized in the following so as to provide a 
frame of reference and basis for understanding: (l) difficulties or pro- 

blems in mission operation as a result of the design selected, (2) how it 
should or should not have been done (hindsight), and (3) the work-around 
techniques that were possible because of the design flexibility. 


Major program accomplishments were: 

a) Initial program objectives essentially completed in three flights. 

b) Photographed over 99 percent of visible side of Moon with resolution 
capability at least 10 times better than Earth based observations. 

c) Photographed virtually the entire far side of Moon. 

d) Provided data for the selection of eight candidate Apollo landing sites. 

e) Provided photographs of numerous areas of scientific interest with 
resolution capability of 1 to 2 meters. 

f) Developed techniques to employ vertical, oblique, forward stereo, side 
stereo, and converging telephoto stereo photography to conduct site 
search, site confirmation, and mapping missions of celestial bodies. 

g) Devised operational techniques to command and control three spacecraft 
in lunar orbit at the same time. 
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h) Crashed all spacecraft on the Lunar surface (four of five : upon command 
from the SFOF; and eliminated potential future problems of unwanted 
communication from the spacecraft or of collision with Apollo. 

i) Provided the Apollo Manned Space Tracking Network with a live model 
for training purposes during the L.O. extended missions. 

j ) Provided radiation data in the lunar environment. 

MISSION I 


L.O. I (spacecraft number 4) was launched August 10, 1966. 

a) Photographed nine potential landing sites in a southern latitude band 
of Apollo zone of interest with eight meter resolutions. 

b) Eliminated some potential Mission II sites from further consideration. 

c) Accurately established the desired lunar orbit characteristics. 

d) Provided data for lunar gravitational model for 12 degree orbit 
inclination. 

e) Performed 574 attitude maneuvers, five velocity maneuvers, and pro- 
cessed 4j510 transmitted commands. 

f ) Obtained the first oblique photos of Moon and the Earth as seen from 
the vicinity of the Moon (Figure 2-3). 

g) Obtained the first high quality photos of the far side of the Moon. 

h) Transmitted more than 400 photographs to Earth, providing photographic 
coverage of about 150,000 square miles of the lunar surface visible 
from Earth and about two million square miles of the Moon's far side 
were photographed from about 1000 miles above the surface. 

MISSION II 


L.O. II (spacecraft number 5) was launched November 6, 1966. 

a) Photographed 13 potential landing sites in a northern latitude band 
of Apollo zone of interest with one meter resolution. 

b) Improved oblique photography control and pointing procedures (e.g., 
Copernicus photo. Figure 2-4). 

c) Photographed 17 secondary photo sites within the orbit inclination 
limits on front and far sides of the Moon. 

d) Identified Ranger VIII impact area. 

e) Developed procedure to synchronize DSN station clocks to within 50 
microseconds . 
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Earth was photographed by Lunar Orblter I from 232,000 miles away. With the 
Moon in the foreground, this photograph closely duplicates the scene astronauts 
will view as they prepare to land on lunar surface. Center of Earth in the 
photo is Bechuanaland, South Africa. Lunar horizon spans about 450 miles and 
is 1500 miles away from Lunar Orbiter's camera. 


Figure 2.-3: EARTH AS SEEN FROM MOON 



Copernicus Crater, with mountains rising to approximately 3000 feet with slopes 
up to 30 degrees, was photographed by Lunar Orbiter II from an altitude of 28.4 
miles and 150 miles away. 


Figure 2.-4: COPERNICUS CRATER 
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f) Performed 284 attitude maneuvers, seven velocity maneuvers, and pro- 
cessed 3,571 transmitted commands. 

g) Survived four known micrometeoroid impacts. 

h) Changed its orbit inclination from 11.8 to 17.5 degrees to provide 
scientists with additional information about the Moon's gravitational 
field. 

i) Transmitted 417 photographs to Earth. 

MISSION III 

L.O. Ill (spacecraft number 6) was launched February 5, 1967. 

a) Photographed 12 potential Apollo landing sites selected from Missions 
I and II. 

b) Photographed 31 secondary sites within the 21 degree orbit inclination 
on front and far sides of the Moon. 

c) Performed the first comprehensive photographic site confirmation 
mission. 

d) Positively identified the landing site of Surveyor III and photographed 
the Surveyor I landing site and spacecraft (Figure 2-5). 

e) Provided data for lunar gravitational model for a 21 degree orbit. 

f) Performed 383 attitude maneuvers, 7 velocity maneuvers, and processed 
3,615 transmitted commands. 

g) Completed the primary Apollo requirements for photographic information 
from an Orbiting Spacecraft. Coverage provided by L.O. Ill was: 

o Prime sites - 2,200 square miles high resolution 

11,500 square miles wide angle 

o Secondary Photography 

Near side - 350,000 square miles area of scientific interest 
e.g., Kepler (see Figure 2-6). 

Far side - 900,000 square miles. 

h) Transmitted 327 photographs to Earth. 
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This 350- by 500-foot area was photographed by the high-resolution camera 
aboard Lunar Orbiter III. Surveyor I can be detected as a white object casting 
a shadow approximately 30 feet long. The spacecraft was located by triangu- 
lation of distant objects seen by Surveyor I cameras. 


Figure 2.-5: SURVEYOR I LANDING SITE 



Lunar Orbiter Ill's wide-angle lens captured this view of the lunar horizon. 
The most prominent crater La Kepler, approximately 20 miles in diameter and 
over 1 mile deep. The smaller, almost perfectly formed crater to the right 
is about 1/2 mile deep and 3 miles in diameter. 


Figure 2.-6: CRATER KEPLER 
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MISSION IV 


L.O. IV (spacecraft number 7) was launched May 4> 1967. 

a) Completed first photographic mapping mission of Moon. Over 99 percent 
of near side (7,000,000 square miles) was photographed at resolutions 
of 60 to 100 meters. 

b) Provided first photographs of surface detail for all limb and polar 
regions . 

c) Provided first details of Orientale basin (Figure 2-7). 

d) Provided trajectory data for 85 degrees orbit inclination to improve 
the determination of the lunar gravitational model. 

e) Performed 586 attitude maneuvers, four velocity maneuvers, and pro- 
cessed 7,111 transmitted commands. 

f) Provided data to relocate Mission V sites to increase the scientific 
data obtainable. 

g) Survived two known micrometeoroid impacts. 

h) Operated in orbits with full sunlight for long periods of time. 

i) Transmitted 359 photographs to Earth. 

MISSION V 


L.O. V (spacecraft number 3) was launched August 1, 1967. 

a) Completed photography of the far side and 45 near side photo sites to 
support numerous scientific requirements with resolution down to 2 
meters. Figure 2-8 is from a wide angle view of the crater “tycho. 

b) Provided a near full-Earth photo centered in Indian Ocean showing 
land mass outlines. 

c) Performed 532 attitude maneuvers, six velocity maneuvers, and processed 
4,525 transmitted commands. 

d) Survived the six hour eclipse of October 1967 without difficulty. 

e) Spacecraft was tracked optically in lunar orbit during a special 
experiment utilizing reflected sunlight directed toward Kit Peak 
Observatory. 

f) Provided low altitude high inclination data to improve the determina- 
tion of the lunar gravitational model. 

g) Transmitted 425 photographs to Earth. 
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This photograph was taken by the Lunar Orbiter IV at an altitude of 1690 miles 
and shows the enormous complex called the Orientale Basin. The Cordillera 
Mountains which form the outer scarp are more than 600 miles in diameter and 
rise to an altitude of 20,000 feet above the surrounding surface. Orientale 
is believed to be the most recent of all the Moon’s large circular basins. 


Figure 2.-7: ORIENTALE BASIN 



Tycho, a very young, large crater, was photographed in this crisp detair uy 
Lunar Orbiter V from an altitude of 135 miles. The crater, which is more than 
50 miles from rim to rim, is considered by astronomers and scientists to be 
quite young because the debris associated with its formation is superimposed 
on older topographic features over a large area of the Moon's visible side. 


Figure 2.-8: Tycho 
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PROBLEM AREAS 


Problems experienced during the program are summarized in the following 
paragraphs . 


a) Launch of L.O. I was delayed one month due to the unacceptable photo 
subsystem. During the second launch period launch was delayed one day 
by questionable launch vehicle instrumentation. 


b) Major failures affecting photo data recovery were: 

L.O. I - Telephoto images degraded because focal plane shutter 
control circuitry was susceptible to electromagnetic 
interference. Corrected for missions II through V. 

L.O. II - TWTA failed to turn on 12 hours to planned end of mis- 
sion. 98.5 percent of all photos had been read out. 

L.O. Ill - Film advance motor failed after reading out 73 • 8 percent 
of the 211 dual exposures taken. 

L.O. IV - Film advance problems necessitated early Bimat cut and 
the loss of approximately 20 planned photos of areas 
beyond the western limb. 


L.O. V - None. 

c) Operational problems encountered were: 

1) Star Tracker dint - L.O. I through V 

o Stray light resulted in erroneous signals to star tracker. 

o Satisfactory operation was possible during solar occultation. 

o Periodic attitude update maneuvers were required. 

o Error signals from star tracker were used by subsystem analyst 
to determine and predict roll position. 

2) Spacecraft Thermal Control - L.O. I through V 

o Equipment mounting deck thermal paint degraded from solar 
energy. 

o Spacecraft was pitched off sunline for extended periods to 
provide spacecraft temperature control. 

o Mirrors were added for Missions IV and V to reduce thermal 
energy exposure. 
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3) Intermittent Film Hangup - L.O. Ill 

o Readout of a single framelet was repeated. 

o Real time commands were employed to control and reinitiate 

readout when hangups occurred. Hangup was attributed to inter- 
ference between teflon separators and readout looper rollers. 

4) Film Advance Control - L.O. IV 

o Intermittent film advance logic signals caused readout and pro- 
cessing problems. 

0 Manual commands were employed to set up special logic control 
configuration to allow specific functions and inhibit other 
functions . 

o Real time commands were used to set up automatic reinitiation 
of readout mode at end of each scan cycle. 

5) Camera Thermal Door - L.O. IV 

o Door failed to open on command during first and second photo 
orbits . 

o Real time commands were used to control door operation from 
partially closed to full open. 

6) Photo Subsystem Window Temperature - L.O. IV 

o Condensation developed on window when camera thermal door was 
left open following above problem. 

0 Spacecraft was oriented so that solar energy would maintain 
window temperatures. (Not successful. ) 

o Direct light on window penetrated light baffles and light 
streaked film. 

o Partially closing door gradually eliminated all problems. 

7) Loss of Photo Coverage - L.O. IV 

o Light streaking of film degraded photos of eastern areas. 

0 Mission plans were altered to rephotograph areas by apolune 
photography near end of mission with some reduction in resolu- 
tion capability. 

8) Communications Subsystem - L.O. II, III, and V 

Unintentional commands were received, transferred to the pro- 
grammer, and executed by L.O. II and III during the primary 
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mission of Spacecraft L.O. Ill, IV, and V. These commands occurred 
with the other spacecraft transponder in uplink lock under weak up- 
link signal conditions. Bit errors developed in the address code 
such that commands addressed to another spacecraft would be ac- 
cepted and executed. 

9) Extended Mission Attitude Control - L.O. V 

Loss of 2.5 pounds of nitrogen gas occurred during a weekend 
' period when the spacecraft was not being monitored by the SPOF 
and required that the mission be terminated several months 
earlier than planned. 

SPACECRAFT CONFIGURATION 


The spacecraft configuration is illustrated in Figure 2-9* The Lunar Orbiter 
weighed 85O pounds and when prepared for launch measured five feet in dia- 
meter by five and one-half feet high. During launch the solar panels were 
folded against the base of the spacecraft and the antennas were folded against 
the sides of the structure. When the solar panels and antennas were deployed 
in space the maximum span became seventeen and one-half feet across the an- 
tenna booms, and twelve feet across the solar panels. 

The primary structure consisted of the main equipment mounting deck and an 
upper section supported by trusses and an arch. Located in the upper section 
were the velocity control engine with its tanks for oxidizer, fuel and pres- 
surant, and the attitude control thrusters, remote sun sensors, and the 
switching assembly. The nozzle of the engine extended through an insulated 
heat shield. The equipment mounting deck supported the camera, communica- 
tions equipment, electrical system equipment, and the following G&C compo- 
nents: inertial reference unit, sun sensor, star tracker, and the flight 

electronics control assembly. 

The electrical power system was a solar panel rechargeable battery system 
with voltage regulation and charge control. In full sunlight the solar 
panels would produce about 375 watts ; the battery was rated at 12 ampere 
hours. The electrical system voltage would vary from 22 volts when the 
battery was supplying the load to 31 volts when the solar panels were 
operating. 

The communications system was compatible with the Deep Space Network S-band 
system. It received, decoded, and verified commands sent to the spacecraft 
from earth, and transmitted to earth all data gathered by the Spacecraft. 

A low power operating mode delivered spacecraft performance telemetry and 
data from the lunar environment experiments (radiation and meteoroids) to 
Earth at 50 bits per second. Telemetry was in digital form, and was passed 
through a signal conditioner, a multiplexer encoder and a modulation selec- 
tor before transmission. 

A high power communication mode was used to transmit photographic data in 
analog form and brought into use the spacecraft's high gain antenna and a 
travelling wave tube amplifier. Performance and environmental telemetry 
were mixed with the photographic information in the transmission. 
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In the tracking and ranging mode, the transmitting frequency of the trans- 
ponder was locked to the frequency of the signal being received from Earth 
in a precise ratio. The signals were then used to determine the radial velo- 
city of the spacecraft to an accuracy of about one foot per second. When 
interrogated by the Deep Space Network ranging system, the transponder signal 
measured the distance between the Earth and the spacecraft with an accuracy 
of about 100 feet. This was an important part of the total G&C function and 
the data obtained in this mode was used to determine the necessary commands 
required to perform midcourse corrections and orbit insertion. 

The transponder received a transmitted command from Earth and passed it to 
a decoder where it was stored temporarily. The command was then re-trans- 
mitted to Earth through the transponder to verify that it had been correctly 
received. When verification was confirmed, an execute signal was sent from 
Earth causing the decoder to pass the command along for immediate or later 
use as required. The command transmission rate was 20 bits per second. 

Spacecraft temperature control was provided to maintain desired component 
temperatures. An aluminized mylar thermal barrier enclosed the area between 
the insulated upper heat shield and the equipment mounting deck. Indium 
foil .005 inch thick was used between high heat dissipating components and 
the equipment mounting deck to provide a known heat transfer coefficient. 

The interior of the spacecraft was tied together thermally and the primary 
means of heat transfer was the equipment mounting deck, which faced toward 
the sun when the spacecraft was in a sun reference attitude. The equipment 
mounting deck was coated to obtain a high heat emission-absorption ratio to 
provide an equipment deck temperature between 85 and 35 degrees F when in 
orbit about the Moon. 

GUIDANCE AND CONTROL SYSTEM 


The Lunar Orbiter G&C system is illustrated in the functional block diagram 
of Figure 2-10. The primary functions performed by the G&C system were 
attitude control, velocity control,' and sequencing and timing of spacecraft 
events . 

The system provided three axis stabilization and control of the spacecraft, 
utilizing a design concept that simplified the spacecraft functions and 
equipment by placing greater emphasis upon Earth-based facilities. The 
total G&C function was accomplished by the spacecraft G&C elements working 
with the Deep Space Network, Space Flight Operations Facilities, and the 
flight operations team through the communications subsystem. A key factor 
in this implementation was the ability to utilize the decision making ability 
of the flight operations team. The twofold result of this system approach 
was first the realization of a spacecraft system that was simple, reliable 
and straightforward to operate, and secondly a flexible G&C system that 
could accommodate both a wide variety of mission tasks and flight anomalies. 

The guidance and control system was composed of the hardware items below J 

l) Flight Electronics Control Assembly - all parts of the G&C system were 
interlinked by this unit. It consisted of two distinct functional 
sections, a programmer and closed-loop electronics. The programmer 
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was a low-speed digital data processor, with memory capacity large 
enough to provide sixteen hours of control from stored commands. It 
controlled all timing and sequencing of spacecraft events. It inte- 
grated the maneuver magnitude signals from the gyro or accelerometer. 

The closed loop electronics performed the tasks of attitude control. 

It was basically all analog in operation, accepting error signals from 
the sensors and gyros, and controlling the reaction thrusters and 
thrust vector control actuator upon command from the programmer. 

2) Inertial Reference Unit - this unit consisted of three single-degree- 
of-freedom, floated, rate-integrating gyros, and one pulsed integrating 
pendulum-type accelerometer. The gyros operated in either of two modes 
selected by the flight electronics control assembly; rate mode or rate- 
integrate mode. The accelerometer was on but readout only during velo- 
city maneuver. 

3) Sun Sensors - there were five sensors on the spacecraft that provided 

4 IT steradian coverage to assure sun acquisition and maintain pitch and 
yaw attitude. Four remote coarse sensors were located at the corners 
of the heat shield; the fifth, a combination coarse and fine sensor 
viewed through the equipment mounting deck. 

4) Star Tracker - the celestial reference for the spacecraft roll axis 
was provided by this unit. It produced a roll error signal and a star 
map voltage that was transmitted via telemetry. The flight operations 
team interpreted the star map to provide assurance that the tracker 
was looking at Canopus rather than some other' star. 

5) Reaction Control - eight reaction control thrusters using nitrogen gas 
generated the torque necessary to control the spacecraft in roll, pitch 
or yaw. Approximately 14 l/2 pounds of nitrogen were stored in a tita- 
nium sphere at a pressure of 3500 psi. Ten pounds were budgeted for 
attitude control, and four were used for pressurizing the fuel and 
oxidizer tanks. 

6) Thrust Vector Control - spacecraft attitude in pitch and yaw was main- 
tained during velocity maneuvers by a gimbaled engine. The engine was 
positioned by two actuators responding to error signals from the gyros. 

These six items of the G&C system were interconnected by the flight electro- 
nics control assembly to form four functional subsystems. Many of the re- 
quirements and much of the functional development was accomplished on this 
subsystem basis, even though some elements were not exclusively a part of 
only one subsystem. The four subsystems and the items that composed each 
one, were as follows: 

1) Attitude Control Subsystem - including the programmer, sun sensors, 
star tracker, closed loop electronics, and inertial reference unit. 

2) Reaction Control Subsystem - included the programmer, reaction thrusters, 
regulators, N 2 supply, and plumbing. 
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3) Thrust Vector Control Subsystem - included the programmer, thrust 
vector actuators, closed loop electronics, and inertial reference 

' unit. 

4) - Velocity Control Subsystem - included the programmer and accelerometer. 
Section 3-0 through 6.0 discuss each of these subsystems individually. 
GUIDANCE & CONTROL SYSTEM DEVELOPMENTAL GUIDELINES 


The development guidelines which had a major impact on the spacecraft and 

the Guidance and Control system are listed in the following paragraphs. 

The overall program schedule with selected emphasis on Guidance and Control 

events is shown in figure 2-11. The major events recur in discussions of 

particular development problems. 

1. Compatibility between the spacecraft and the Atlas Agena booster was 
required. Most important effects were the launch envelope allowed 
and the booster environment — acceleration, vibration and tempera- 
ture. 

2. Use of off-the-shelf, space proven, and high reliability hardware 
wherever possible was a program requirement coupled with a thorough 
quality assurance program from the program start. All modifications 
to existing hardware were analyzed and tested as carefully as though 
it were a new design. 

3. A comprehensive test and qualification program was required that en- 
compassed all levels of test beginning with fabrication testing and 
concluding with spacecraft launch and checkout. This included not 
only functional- and environmental test of all flight hardware, but 
development, qualification, and reliability demonstration tests of 
components, subsystems, systems and the entire spacecraft. 

4. In addition to providing flight performance information in real time, 
it was an objective that spacecraft performance telemetry be sufficient 
for monitoring all subsystem and component performance to a level ade- 
quate to isolate problems to the black box replacement level for all 
spacecraft level tests. 

5.. Modular design was provided as illustrated by the propulsion and reac- 
tion control assembly. The advantage was in being able to assemble, 
test, and service the module without later changes to the plumbing re- 
quired by a higher assembly level. 

6. An unwritten but often quoted philosophy when choosing between alter- 
natives was; "Put the intelligence on the ground." The objective was 
to keep the spacecraft and its functions simple, by assigning the 
flight operations team the responsibility of decision making. 

7. The spacecraft reliability goal for the successful completion of a 
30-day mission was 0.70 based on a realistic single thread assessment 
of state-of-the-art hardware. The reliability allocation to the gui- 
dance and control system was .83. 
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FIGURE 2-11 LUNAR ORBITER PROGRAM SCHEDULE 
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8. The spacecraft was to remain in orbit after completion of the photo- 
mission with suitable equipment working for an extended lifetime to 
obtain additional selenodetic and environmental data. The lifetime 
goal was one year. 

GUIDANCE AND CONTROL SYSTEM DESIGN CONSTRAINTS 


The system requirements were: 

1. To acquire the sun within 20 minutes from staging from the launch 
vehicle and to maintain a sun orientation for power and thermal 
control. 

2. To establish and maintain a Sun-Canopus reference attitude of the 
spacecraft anytime after six hours from injection on translunar tra- 
jectory. 

3. To perform up to two midcourse velocity maneuvers as required. 

4. To perform velocity changes to inject into initial and final orbits 
about the moon. The three sigma inaccuracy allowed for velocity 
maneuvers was not to exceed .5 feet/second plus 0.0008 times AV feet/ 
second. 

L 

5. Perform maneuvers in space from the reference attitude for photography, 
velocity change, or communication with reorientation error not to ex- 
ceed .75 percent of the commanded maneuver. Maneuvers about any axis 
of at least 180 degrees were required. Return to the reference atti- 
tude was required. 

6. To maintain the proper attitude during engine firing. 

7. Point the high gain antenna at Earth within the beam width of the an- 
tenna for- the 30-day mission. 

8. To provide sequencing and timing of all spacecraft events, with a 
timing resolution of 0.1 second. 

9. To provide at least 5 percent side overlap between pictures taken on 
successive orbital passes. 
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3.0 ATTITUDE CONTROL SUBSYSTEM 

The Attitude Control Subsystem (ACS) was one of four subsystems that con- 
stituted the spacecraft G&C system. The relationship of the ACS to the 
total G&C system is illustrated in Figure 3.1. 

3.1 SUBSYSTEM DESCRIPTION 

The ACS subsystem was basically a rate limited, conventional on-off, cold gas 
reaction control. A basic reference attitude was established by a Sun sensor 
and star tracker. A rate damping signal was provided by a rate gyro for each 
axis during normal celestial hold operation with the Sun sensor (Pitch and Yaw) 
or star tracker (Roll). During Sun and Canopus occulta tion periods attitude 
was maintained by the gyros in the rate integrate mode. Lead-lag networks 
provided stability. 

The functions of the attitude control were to: 

1) • Acquire, stabilize, and maintain a Sun orientation of the spacecraft in 

pitch and yaw. 

2) Acquire, stabilize, and maintain a Canopus referenced orientation in roll. 

3 ) Maneuver sequentially one axis at a time away from celestial references 
as desired, e.g., for photographic or velocity change purposes. 

4) Hold attitude to inertial references as required, e.g., for photo sequences, 
for velocity changes, and for periods of sun and Canopus occultation. 

5) Return spacecraft to celestial reference orientation upon completion of 
above maneuvers. 

6) Point the high gain antenna. 

7) Provide delta velocity measurement and control for engine burns. 

The attitude control block diagram for one axis is shown in Figure 3-2. The 
design features of the hardware components are discussed as individual topics 
in paragraph 8.0. The modes of attitude control operation, were controlled 
by the flight programmer shown on the left side of Figure '3-2. 

The center portion of Figure 3-2 was called the closed loop electronics 
portion of the Attitude Control subsystem and was physically located in the 
Flight Electronics Control Assembly. The remaining elements on the right of 
Figure 3-2 are the sensors, torquers and spacecraft dynamics. 

Each axis was controlled independently (except that all deadbands were switched 
together and sun sensor select operated both pitch and yaw). The operating 
modes provided for limited rate about any axis, attitude hold to celestial and 
inertial references, maneuvers of precise magnitude, and logic to provide 
for occulta tions . These modes will be described in the following paragraphs, 
using the sequence of a normal mission. 
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3.1.1 Sun Acquisition 

The initial Sun Acquisition was accomplished according to Figure 3-3- For this 
initial acquisition, the sun sensor field of view was 4 tt steradian. The 
output from the sun sensor amplifier was limited with a soft limiter. This 
attitude error limiter had the effect of a rate limit on the system for large 
errors. Depending upon the deadband chosen, the rate range was nominally 0.55 
+0.5 degrees per second for the 2.0 degree deadband and 0.55 + 0.05 degrees 
per second for the 0.2 degree deadband. The time allowed for the sun acquisi- 
tion, after Agena separation was limited to 20 min. by battery capacity. The 
narrow deadband was chosen for this task to assure that the acquisition rate 
would be at least 0.5 degrees per second. During Sun acquisition, the roll 
axis was operated in a rate limited mode, with the Canopus tracker "OFF" 
until after the spacecraft had passed through the Van Allen radiation belts. 

3.1.2 Canopus Acquisition 

Approximately six hours after launch, the Canopus Tracker was turned on. The 
planned Canopus Acquisition sequence shown in Figure 3-4 was initiated. A 360 
degree maneuver was commanded during which time a star map was telemetered to 
the ground. This star map was compared to a computer calculated a priori star 
map from which the roll angle of the spacecraft relative to Canopus at the end 
of the 360 degree maneuver was defined. A second maneuver was commanded to 
orient the spacecraft with as small a roll error relative to Canopus as 
possible. The tracker switched from search to track and issued a "Canopus 
present" signal. The third maneuver in the sequence was an Acquire Canopus 
command which switched the control of roll error to the tracker. 

3.1.3 Attitude Maneuver 

The Lunar Orbiter maneuver sequence was different from any method used up to 
that time in a spacecraft. The sequence is outlined in detail in Figure 3-5. 

For the maneuver sequence, the deadbands for all axes were first narrowed to 
0.2 degrees. This provided tight control on the vehicle rate during the 
maneuver and also guaranteed the vehicle position to be within 0.2 degrees 
of null at the start of the sequence. After a wait time of 51.2 seconds to 
stabilize in the new limit cycle, the maneuver was initiated by simultaneously 
applying a 0.55 + 0.05 degree per second slew voltage to the maneuver axis, 
and switching the IRU rate signal to a voltage to frequency pulse converter 
which, in turn, was connected to the Programmer's pulse counting register. The 
control system nulled the slew voltage and rate gyro signal by firing the proper 
jets to bring the S/C to the commanded rate. The integration register in the 
programmer would count the output pulses of the V/F converter and compare the 
accumulated count with that stored in the memory for the commanded maneuver. 

When the maneuver was completed, the slewing signal was removed, and the gyro 
switched to the integrating mode. This fixed the null of the gyro to the 
desired end point of the maneuver. The vehicle was controlled during the 
maneuver hold period with jet pulses commanded by the inertial hold lead-lag 
compensation network operating on the attitude error output from the gyro. 
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-3.2 DESIGN REQUIREMENTS 


The design requirements of the attitude control subsystem were developed from 
a nominal 30 day photo mission with a one year extended life capability. Figure 
3-6 correlates the requirements with mission events. A qualitative discussion 
of the design features required of the attitude control subsystem is listed 
below. A discussion of component tolerances is contained in the respective 
component sections. 

DESIGN FEATURE REQUIRED BASIS OF REQUIREMENT 


1. Three axis stabilized 
configuration. 


2 . Conventional ON-OFF 
Reaction Control but 
with "One Shot" on jet 
valve driver. 


3. Inertial reference unit with 
rate and rate integrate 
modes from gyros. 


4. Celestial sensors: 

a) Fine sun sensor, coarse 
sun sensor, aft remote 
sun sensors. 

b) Canopus Star Tracker 
with magnitude telemetry 
and presence gates at 
1/3, to 3X Canopus in- 
tensity. 


To obtain the required 1 meter resolution 
from orbit demanded the choice of a photo- 
graphic camera to obtain, store, and play 
back the topographic information rather 
than by a television system. Image smear 
during the photo exposure time was of prime 
concern. A spin or dual spin stabilized 
configuration would have been more complex 
to compensate for image motion. 

Cold gas reaction control was proven 
for long reliable life by JPL Interplanetary 
Spacecraft (Mariner). One shot for minimum 
impulse bit was selected to suit good 
performance state of art valves. Boeing 
laboratory experience was source of one- 
shot feature. 

Unique orbiter requirement was to hold 
reference attitude with either Sun or 
Canopus occulted. Accurate rate informa- 
tion was required to maneuver, to stop 
initial tumbling, and for damping with 
celestial sensor position references. 

Complete 4*7r steradian coverage was pro- 
vided to assure sun acquisition. Coarse 
and remote eyes were switched out on 
command to prevent pointing errors from 
secondary radiation sources such as the 
moon or earth. 

Canopus is second brightest star; only 
14*5° away from South ecliptic pole, with 
no other bright stars nearby. Therefore 
a star map generated by rolling 360° about 
sun line would provide unique Canopus 
identification by comparison with a priori 
star map. Thus a unique celestial referenced 
coordinate system is established by a line 
to the Sun (for pitch and yaw) and to 
Canopus (for roll). 
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5. Wide and narrow deadzone Accuracy for photo and delta velocity 

provided by "two step gain" maneuvers demanded deadzone no greater than 
change on switching amplifier 0.2°j to prevent large limit cycle pro- 
(Gain of 1 or 10) as commanded pellant penalty during coast periods 
by the Slight Programmer. required 2.0° or larger deadzone. Gain 

change method retained switch line slope 
with rate to position ratio of 4*1 and 
an overdamped response for propellant 
conservation. 


6. Lead-lag derived rate from 
inertial reference unit in 
the rate integrate mode 
with passive R-C networks. 


Transfer function selected to provide near 
optimum time response for convergence from 
maneuver rate of .5°/s.ec and be overdamped 
at lesser rates for propellant conservation. 


7. Slew plus or minus (for 

attitude maneuvers at 0.5°/ 
sec. 


8. Switch yaw control to 
photograph V/H crab 
angle control. 


9. Solar Detector (Solar 
panel array voltage). 


10. Provide attitude control 
for primary mission and 
extended mission with 
10 LB of $2 S as - 

11. 1.0 Volt per degree and 4 
volts per degree per sec. 
for sensor scale factor. 


To obtain photos at proper surface illumi- 
nation angle following occultation (A.M. 
photography) required the maneuver rate to 
be approximately .5°/sec. Other maneuvers 
could have been at lower rate. Both plus 
and minus maneuvers required to minimize 
total maneuvered angle and give most 
accurate orientation. 

This feature, though provided, was never 
used in flight operations because it was 
not needed and did not work very well 
because of noise. Early requirement was 
based on anticipated inability to predict 
orbit track and spacecraft attitude to pre- 
vent lateral image smear as would result from 
yaw angle (crab) errors greater than 0.5°. ' 

A sun "not present", as indicated tjy lack 
of solar array voltage, initiated switching 
logic to place IRIJ pitch and yaw axes into 
rate integrate mode so as to hold inertial 
attitude during sun occultation periods. 

A similar logic was provided by Canopus 
"not present" signal. 

Weight limit of spacecraft limited control 
gas available. 


Selected on basis of electrical noise level 
expected with solid state electronics and 
to make noise effect small on a .2° 
deadzone. 
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12. Only solid state switches Reliability for attitude control sub- 
used throughout this sub- system could not be achieved with relays, 

system. reliability required was .88 for 30 day 

mission. 

3.2.1 Gas Budget Requirements 

The impulse requirements for attitude control were determined by accounting for 
every detail item of impulse. These were grouped in the following 5 major 
categories : 

1. Major rate increments 

a) Initial damping of booster tip off rates 

b) Initial Sun and Canopus acquisition 

c) All maneuvers? midcourse, injection, orbit change and photo maneuvers. 

♦ 

2 . Limit cycle 

Deadzone width and time were the variable factors. Because of the un- 
certainty in ability to obtain limit cycle rates of .001°/sec. correspond- 
ing to a single 11 millisec. pulse, .0025°/sec. was arbitrarily assigned 
as the minimum predicted rate. 

3. Disturbances 

a) Solar pressure acting to produce torque over the mission time was 
determined. 

b) Gravity gradient torque time history was determined. 

c) The net disturbance torque was integrated over the mission time to 
give the impulse requirement. 

4. Celestial reference reacquisition following an oecultation 

The consequence of occultatioir and re-appearance of the celestial 
references is a unique problem of an or biter. Reacquisition may impose 
severe gas requirements if the design fails to anticipate the problem. 

5 . Leakage 

This is the total system leakage and was treated as a random quantity 
producing no net torque on spacecraft. 

The conservative way of obtaining gas requirements is to simply add them 
up for each individual axis as impulse requirements. To the extent that 
limit cycle and disturbances strongly interact this is an over simplifi- 
cation of the problem. The experience of Lunar Orbiter was that gas 
usage was less than the simple addition of predictions for limit cycle 
and disturbance. 
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3.3 DEVELOPMENT AND OPERATION 

There were no changes to the attitude control hardware design for any of 
the 5 flight spacecraft. This was due in part to the maturity of the 
design as a result of a thorough developmental and qualification test 
program; also due to the ingenuity of the designers, analysts, test engi- 
neers, and flight operations people in devising work-around methods or in 
exploiting inherent capability of the existing hardware. To expose this 
information in an orderly manner the listing of design changes will be 
discussed for periods between major mileposts related to the program 
schedule . 

3.3.1 Proposal Submittal to Contract Award 

One change to the spacecraft mission which had a major impact on the atti- 
tude control was to be capable of continuing in operation for one year. 

The primary photographic mission required approximately one calendar month. 
The extended life goal of eleven additional months was desired to provide 
extended periods of time for obtaining lunar environment and selenodetic 
data by means of tracking through the DSIP. The proposed design solution 
was to simply allow the spacecraft to continue in operation in much the 
same manner as for the primary mission except that there was no requirement 
to maneuver and point the high gain antenna. This meant no firm require- 
ment for an absolute roll reference. An additional 2.6 lb of Attitude Con- 
trol gas was allocated to provide coarse stabilization to the sun line. 

The gas requirement was based on a simple extrapolation of the propellant 
requirement for a wider deadzone limit cycle for an additional eleven 
months. The inadequacy of this estimate will become evident in the dis- 
cussions which follow. 

3.3.2 Contract Award to Preliminary Design Review 

Changes during this period occurred as a result of detail design and analy- 
sis efforts. It was also during this period that the total spacecraft 
weight became a major problem and forced the decision between alternatives 
in favor of the lighter method. 

The first class of changes to be discussed are those resulting from problem 
areas that were not anticipated in the proposal but which were identified 
before the Preliminary Design Review (PDR). 

1. Reacquisition of Celestial References 

A unique problem of an orbiter spacecraft is how celestial oecultations are 
handled. Orbits for the Lunar Orbiter photo mission resulted in typical 
Sun oecultations of 45 minutes out of each orbit period of 200 minutes. 
Canopus could be occulted with similar frequency. The Lunar Orbiter design 
concept was to automatically switch the gyro to inertial hold when the 
celestial sensor was not present. Likewise the celestial sensor error sig- 
nal was to be switched back into the control loop when the occultation 
period was over. 
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The probability of being outside the switch lines at sunrise was not properly 
assessed. Gyro drift had been considered but not the null shifts from being 
at an unknown random position within the + 2° deadband at the time of occulta- 
tion. Figure 3-7 illustrates the sequence for the pitch axis; yaw would be the 
same. Roll would be a variation of the same idea.. The penalty for one re- 
acquisition illustrated above would be twice the Q expended at sunrise to get 
back inside the switch lines. A l°/sec $ used approximately .007 lb. of N 2 gas. 

The total gas penalty for each axis would be .the sum' of these individual 
amounts which would be dependent on a more or less random position in the 
deadzone at both sunset and sunrise. 

2. Maneuver Initiation 

The sequence proposed for initiating a maneuver of the spacecraft was to: 

a) Close the deadzone to +.2 degrees. 

b) Wait for a zero crossing of the celestial sensor. 

c) Slew plus or minus with gyro switched to rate mode. 

Analysis showed that closing the deadzone on each orbit caused the expenditure 
of approximately .02 lb. of Np per 3 axis closure. Continuous operation in a 
+ .2 degree deadzone used only .014 lb N 2 per orbit. Therefore,- a saving of 
.007 lb of N 2 per orbit could be had by continuing in the .2 degree deadzone 
instead of closing the deadzone once per orbit from a 2° deadzone. 

The "Wait for zero crossing" idea was originally proposed to eliminate the 
inaccuracy contributed by the position uncertainty within the deadzone. 

Analysis showed that - there was a strong possibility that disturbance torques 
(gravity gradient and solar pressure) would be sufficient to cause an unsym- 
metrical limit cycle and if. already in the .2 degree deadband, no zero 
crossing would occur. Thus it was concluded that maneuver time uncertainty 
of the zero crossing negated its value and it was eliminated from the design. 

The final design provided for a deadzone closure of all axes upon command from 
the flight programmer followed by a 51.2 second wait time for settling, 
immediately followed by the slew command to the axis being maneuvered. Another 
feature which was incorporated in the pitch and yaw channel was a limiter on 
the sun sensor at 2.4 volts. The limiters prevented the reaction control from 
accelerating the spacecraft to a high rate when acquiring the sun from a large 
angle. 

3. Wide Field of View Sun Sensor Errors 

Pointing errors introduced into the sun sensor by secondary radiation from 
the moon could have caused pitch or yaw errors of approximately l u to 2° 
because of the wide field of view of the sensor proposed. The solution 
was to provide a fine and a coarse sun sensor, selectable by command from 
the flight programmer, and to switch out the wide angle coarse sensor when- 
ever the coarse sun sensors were not required. 
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FIGURE 3-7 PHASE PLANE FOR SUN OCCULTATION AND REACQUISITION 
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4. Extended Life 

The method of providing an extended life capability of eleven months follow- 
ing the primary photo mission of 30 days remained an -unsolved problem for 
most of the time period preceding the PER. Several alternatives were examined 
and rejected. One of the most promising was to operate the gyros in the rate 
integrate mode and to slave the gyros to the celestial sensor error signal. 
Projected gas requirements to continue operation in the same manner as during 
the 30 day photo- mission, i.e., with Sun and Canopus reacquisition each orbit, 
were prohibitively heavy. The major item requiring the greatest propellant 
expenditure was the celestial reacquisition problem discussed under item (l) 
above . 

The proposed design solution presented at the PDR involved an operational 
concept without much change in control hardware. The gas quantity allocated 
to extend the life to 1 year ranged from 2.6 lb to 5.90 lb. The 2.6 lb was 
simply an optimistic estimate of required limit cycle gas in a vide deadzone. 

The 5.90 estimate was based on analyses that included probability of reac- 
quisition, disturbances, and leakage requirements. The operational method 
proposed to be employed was as follows: 

a) Control roll to + 2 degree limit cycle with roll gyro in rate integrate mode. 

b) Operate pitch and yaw in wide deadzone with coarse sun sensors only - this 
provided deadzones in the range of + 10 degree to + 16 degree. Also 
lowered the probability of requiring a celestial reacquisition each orbit. 

Another important outgrowth of this analysis was the philosophy that the 
quantity of control gas was fixed at 10.53 lb. Reserves- and safety factors 
became expendables available to extend mission life, but could be traded 
off for more maneuvers or for other mission options. 

5« Thrust Vector Control 


Thrust vector control by means of gimbaling the rocket engine instead of 
high level reaction control jets located at the tips of the solar panels was 
a major change and is discussed under Thrust Vector Control Subsystem, 

Section 5.0. 

The low. level reaction control jets were relocated on the rocket engine heat 
shield and are discussed in detail under Reaction Control Subsystem, Section 4*0. 

6. Location of Antenna In View of Canopus Tracker 

Initially the low-gain antenna was located in the direct field of view 
of the Canopus tracker. The antenna location was originally selected be- 
cause of the desire to maximize the signal strength received at earth over 
the low gain radio link. Since the antenna pattern was torroidal the idea 
was to put the plane of the torrid near the earth moon or ecliptic plane. 

The antenna pattern was broad which allowed shifting the boom and antenna 
away from the tracker optical axis. In the final design the object nearest 
the tracker field of view was the tip of the antenna. It was 23 l/2° from 
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the optical axis of the tracker. As can be seen from the discussion of 
the Canopus tracker operational problems in section 3.3.6 this was proba- 
bly not far enough! 

3.3*3 Preliminary Design Review to Critical Design Review 

The emphasis during this period (approximately 3 calendar months) was on 
establishing the adequacy of the detail design. A series of development 
tests were run on the attitude control components and subsystem. Perfor- 
mance tests of the breadboard attitude control subsystem were conducted 
on an air bearing simulation of the spacecraft. Data obtained confirmed 
the soundness of the design concepts. Some potential problem areas were 
identified (e.g., electrical noise from sources such as the gyros, thruster 
operation, or other switching transients). 

The principal design change was to reduce the roll thruster force level to 
.028 lb from .05 lb. This force level gave similar torque to inertia ratio 
capability to the roll axis as existed in pitch and yaw. Analysis also 
indicated a potential N 2 § as saving over the entire mission of 0.8 lb. 

The pitch and yaw thrusters were oriented so that plus and minus jets 
thrusted in opposite directions. This jet orientation was selected to 
minimize the net accelerations imparted to the spacecraft by attitude con- 
trol. It was desired to make the unpredictable accelerations on the space- 
craft as near zero as possible because the effect would be to cause -errors 
in the gravitational model deduced from orbit determination data. 

3.3.4 Critical Design Review to System Design Verification Tests 

The actual design changes to the attitude control during this time were 
minimal. Analyses refined the propellant requirements. Breadboard tests 
of the 3 axis control system were completed and a high level of confidence 
was obtained in the ability to predict the control performance in space. 

Effects of component tolerances on system operation were re-evaluated ac- 
counting for all known tolerances. The impact on attitude control of com- 
ponent tolerances or of specification changes was assessed frequently as 
demanded by the difficulties in meeting component requirements as set by 
prior procurement specifications or by test requirements. 

One important design philosophy was adopted in this time period which eased 
the component and spacecraft assembly problems considerably. Namely, it 
was decided to calibrate the spacecraft by measuring alignment of important 
items rather than require the precise installation of the item on the space- 
craft. The resulting alignment data would be incorporated into the command 
software computer programs as necessary. Examples of this alignment pro- 
cess were: 

o Sun sensor null to spacecraft X axis 

o Canopus tracker reference mirror to spacecraft Y and Z axis 
o Center of mass location relative to X, Y, and Z 
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o IRU mirror relative to Sun sensor and Canopus tracker mirror 

o High gain antenna relative to reference sensors 

o Camera optical axis relative to X, Y, and Z 

3.3.5 System Design Verification Test to Actual Flight Operations 

System, subsystem, and component problems came to light as a result of 
ground tests. One set of flight type hardware designated "Set C" was used 
to assemble a complete spacecraft. A logical buildup of tests by compo- 
nent and subsystem preceded the system integration tests at the spacecraft 
assembly level. An important milestone in the development of the attitude 
control was the Subsystem Design Verification Test (referred to as SDV^). 

The purpose of the first of these tests was to demonstrate compatibility 
among components when connected together electrically. The flight Elec- 
tronics Control Assembly was checked with the Star tracker, the IRU, and 
the Sun sensor. Open-loop performance measurements were made whenever 
possible; for example, to check maneuver accuracy on the rate table. 

Closed loop tests of the attitude control were conducted on an air bearing 
platform simulating the spacecraft. The purpose of these tests was to ob- 
tain verification of correct functioning of the flight hardware. 

All of the major functions of the attitude control were observed. This was 
the first closed loop demonstration of a precise maneuver magnitude. 

The unexpected events which occurred were: 

1) Programmer would not execute stored programs. 

2) IRU lost power whenever oscillator clocks were switched over from 
Clock A to B or vice verfea. 

3) Inaccuracies in performing maneuvers on the air bearing occurred. 

Design changes resulting from these anomalies were: 

l) Beat frequencies between the two Programmer clock oscillators were 
Interfering with normal execution of stored program commands. Pre- 
vious evaluation tests on the programmer had been done with a test 
set connected to be able to monitor operation. The air bearing test 
was the first time it was possible to observe the operation without 
extraneous equipment attached. Evidence of the problem was simply a 
hangup in the stored maneuver program where the simulated spacecraft 
would not maneuver back to reacquire the sun or continue in the 
stored program. The cause was isolated to extraneous bits appearing 
in the command word as a result of cross talk or beat frequencies 
between the two clock oscillators. Circuit changes required to cor- 
rect this deficiency were incorporated. 
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2) BUT power was lost at clock switch over due to a state change in the 
programmer. This problem was tied up with item (l) above and circuit 
changes corrected the problem. 

3) Maneuver accuracy was questioned because: 

a) 3 axis air bearing tests could not verify closed loop maneuver 
precision because measurement equipment was not precise enough. 
Also too many test effects obscured the real accuracy; e.g., 
earth rate, 11 g" sensitive drift and position instrument 
inaccuracy. 

b) Spike noise from the IRU was out of spec, and had a detrimental 
effect on maneuver accuracy. Changes to the IRU were incorporated 
to reduce the spike noise. Later tests on the precision rate 
table indicated maneuver accuracy requirements were met. 

The conclusions reached from these test experiences were: 

l) Overall system accuracy evaluations are the most difficult to measure 
in ground tests. Some short cuts initially implemented to save sche- 
dule time and money had to be reworked-; for example, a precision rate 
table test with the programmer and IRU operating together was essen- 
tial to evaluate maneuver accuracy. 

2 .) Test specifications were based on space operating requirements and 
errors allowable in an earth test environment were greater. Insuffi- 
cient effort was put into analyzing the effect beforehand. Whenever 
an inaccuracy (for out of tolerance test result) occurred, it was 
difficult to answer the question as to the cause; design deficiency, 
true failure of a component, or a test environment effect. 

3) A test without ground system checkout equipment or cabling connected 
is essential to obtain a good picture of expected operation. The 
air bearing tests were an invaluable tool in validating the system 
performance. 

4 ) The completed flight spacecraft tests in the 3 axis test stand were 
also an essential ingredient to the operational confidence in the 
attitude control system on all five missions. It gave the test crews 
an operating model which previewed all space maneuvers except actually 
hot firing the engine. 
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3.3.6 ATTITUDE CONTROL FLIGHT OPERATIONS 

Before the first flight a major question was the extent and rate of degrada- 
tion of the thermal coating of the equipment mounting deck due to exposure 
to ultra-violet radiation in space. If the feared degradation occurred, the 
equipment mounting deck and thermal environment was expected to exceed the 
upper design limit of +85 F during translunar flight when the spacecraft was 
in full sunlight. Later in the flight the continued degradation of the 
coatings would also cause excessively high temperatures. An operational 
solution was proposed to be employed if required by the thermal environment, 
namely: to maneuver off sun approximately 35 degrees to maintain the ther- 

mal equilibrium. The consequences of exceeding an average temperature of 
approximately 70 degrees F over a long time period prior to completion of 
photo processing would have been a progressive deterioration of the photo 
processing bi-mat. Mounting deck temperature above approximately 100 de- 
grees F would have caused the temperature control limit on the gyro heaters 
to be exceeded with the resultant loss of fluid viscosity and scale factor 
change. 

Flight Experience - The attitude control system operation for all five mis- 
sions could be considered flawless had it not been for the consistent pro- 
blem of "glint" with the Canopus tracker. The first six hours and 43 
minutes of Mission I were routine and according to plan. At this point 
the Canopus tracker was turned on and a 360 degree roll was made according 
to plan to generate a star map in preparation for the first midcourse cor- 
rection maneuver. Canopus could not be identified. The actual star map 
had no resemblance to the a priori map. Failure to obtain an accurate roll 
reference (Canopus or a reasonable substitute) would have been catastrophic 
to the mission. The second star map was executed three hours and 40 minutes 
after the first attempt and produced similar unintelligible telemetry data. 

Four hours later (and after much analysis) a third star map was made simul- 
taneously with an antenna signal strength map. The antenna roll map corro- 
borated the location of the moon indicated on both previous maps and con- 
firmed that one blip seen on the second star map was Canopus. The moon was 
used as the roll reference for the first midcourse maneuver 13 hours later 
(a total of one day and four hours into the flight). Detailed star map is 
shown in Section 8.3, which discusses the Canopus tracker. 

The diagnosis of the Canopus tracker problem was that the star tracker was 
"tracking" glint reflected from the light baffles ; hence was locked-up at 
full roll error. One major source of stray light was identified as the 
low gain antenna which was located 23 l/2° off the tracker centerline in 
roll. Canopus was finally tracked successfully when in the sun by maneu- 
vering to the roll attitude which placed Canopus near the center of the 
field of view and turning the tracker off and back on by ground command. 

The basis for switching off and on was in the design of the tracker acqui- 
sition characteristics. The first bright object seen by the tracker in 
the search field of view would be tracked. This first object could be 
glint from the sun shade baffles, Canopus or some other star. The off-on 
cycle might have to be repeated several times to "get" Canopus because of 
the location of the star in the field of view, glint, and the unpredictable 
starting point of the instantaneous field of view in the scan cycle. Later 
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in orbit when the sun was occulted by the Moon, the Canopus tracker operated 
correctly and star maps were generated which closely matched the a priori maps. 

The attitude, conduct, and control philosophy of the spacecraft operations 
team changed radically as a result of this experience. The items which 
impacted future operations are discussed in the following: 

1) The pre-planned mission, the timing of events, the rigorous and in- 
flexible operational modes of the attitude control subsystem which had 
been planned for use were discarded from necessity. 

2) The worst fears of the thermal control people about the spacecraft 
overheating were confirmed. Operation of the spacecraft at an angle 

to the sun line provided thermal relief and became accepted as standard 
required practice. 

3) The flexibility of the Attitude Control System to operate for long time 
periods in modes not previously planned was clearly exposed. 

4) The skill of the operations team in being able to fly the spacecraft, 
almost as if in real time, was demonstrated. Many of the flight 
operations people had been intimately involved in the design, analysis, 
and test phases of the program. 

5) The confidence in the attitude control and spacecraft equipment was 
increased by an order of magnitude. 

6) The attitude control propellant wasted in the initial portion of the 
flight (by numerous unscheduled maneuvers) demanded that subsequent 
operations conserve N 2 gas as the prime criterion. Excellent management 
of maneuvers, reduction of the number of reacquisition of celestial 
references, integration of thermal relief off-sun maneuvers with other 
maneuvers, extrapolation of telemetry indicated gyro drift data and 
exploitation of the wide deadzorte mode for both limi t cycle and sun 
acquisition were all used to complete the primary photo mission of Lunar 
Orbiter I with all photos read out and with 2.7 lb. of N 2 gas remaining 
for extended life mission. 
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3.4 CONCLUSIONS AND RECOMMENDATIONS 

The attitude control subsystem performance on all 5 successful flights ade- 
quately demonstrated the quality and soundness of the design concepts and 
hardware used except for the Canopus tracker. In summary the major DO's 
are: 

1) Provide 4 tt steradian coverage to ensure sun acquisition, but be 
able to narrow the field of view to avoid excessive errors from 
outside light sources. 

2) Closed loop attitude maneuvers (one axis at a time) using strap down 
gyros with rate and rate integrate modes provide good precision. The 
reverse maneuver sequence (or unwind) as employed on Lunar Orbiter 
proved especially useful in avoiding unnecessary celestial re- 
acquisitions or searches and provided a means of evaluating the 
maneuver accuracy via telemetry by means of the celestial sensor 
error when the sequence was completed. 

3) Alternate and complementary modes of operation which can be selected 
by ground command are invaluable. Examples which contributed most to 
the Lunar Orbiter success were.: 

a) Roll orientation could be determined by radio signal strength 
from the high gain antenna when pointed at earth and was used 
to corroborate the information from the Canopus tracker. 

b) Star map and roll attitude error signals were of great value 

to the workaround methods of achieving roll attitude even though 
the CST failed to consistently allow Canopus lock-on in the 
sunlight. 

c) Attitude hold using gyro references in inertial hold for long 
periods of time permitted the operation off sun to prevent over- 
heating the spacecraft] also to solve the Canopus tracker glint 
problems. In space, calibration of gyro drift improved the 
efficiency of these workaround techniques. 

d) The reaction control gas supply was adequate for the missions 
because minimum impulse bit limit cycle was achieved and the 
operations team could trade off gas budgeted for extended life 
against extra maneuvers. 

e) The wide and narrow deadzone select option, in conjunction with 
the fine and coarse sun sensor select option, was used to maneuver 
at 0.055°/sec rather than the design rate of 0.55°/sec. These 
options conserved gas. 

f ) Derived rate from lead lag networks provide good acquisition 
characteristics. Electrical noise problems were successfully 
solved before first launch and limit cycle performance with gyros 
in inertial hold using the lead lag circuits also achieved minimum 
impulse bit performance. 
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4) Many of the people manning the flight operations team had intimate 
knowledge of the attitude control system gained through involvement 
in analysis and test from the beginning of the program. Others were 
new to the design and so had no inhibitions about exploring and 
exploiting new capabilities. Without the ingenuity and skill dis- 
played by the flight operations team in working around in-flight 
problems, the program could not have been a success. 

Recommendations for "doing differently if one had it to do over" include 

the following: 

1) Additional features which were desired by the flight operations team 
"if they had it to do over again" were: 

a) The ability to torque the gyros of the IRU or command spacecraft 
slew at some low fixed rates, e.g., increments + .05 degrees/sec. 
Since gyro drifts were very predictable, they could have been 
corrected by torquing pulses controlled in duration through the 
programmer. Hence the effects of gyro drift could have been 
essentially eliminated. 

b) Qyro rate telemetry scaling was selected to confirm limit cycle 
rates and gave a saturated output during all maneuvers. An 
additional scale covering a range of + 1 degree per sec. would 
have been very useful in gas budgeting, and in confirmation of 
maneuvered angle. 

c) A wide angle sun sensor calibration prior to flight would have been 
useful in flying off sun. Such a calibration was made in flight 
from maneuver data. 

2) One disadvantage of _ the operating routine developed for Lunar Orbit er 
which became evident during the extended mission was that a Flight 
Operations crew was required to "baby sit" the spacecraft. There 
were essential required functions, tests, and maneuvers which were 
Interspersed between hours of doing nothing. The result was boredom 
to the operations crew. This was probably a- factor in incorrectly 
compensating for drift, loss of sun power and the unscheduled loss of 
N 2 gas on Spacecraft V. This required that it be crashed much earlier 
than planned. 
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4.0 REACTION CONTROL SUBSYSTEM 

The Reaction Control Subsystem (RCS) was one of four subsystems that 
constituted the spacecraft G&C system. The relationship of the RCS to the 
total G&C system is illustrated in Figure 4-1 • 

4.1 SUBSYSTEM DESCRIPTION 

The RCS, illustrated in Figure 4-2 consisted of the nitrogen storage tank, 
squib valves, filters, pressure regulators, plumbing, and reaction control 
thrusters. The Ng storage tank served as the gas supply for the RCS, and as 
a source to pressurize the fuel and oxidizer tanks in the velocity control 
subsystem; Figure 4-1 illustrates the plumbing and valves associated with 
this function.- The RCS generated the torque necessary to control the space- 
craft about three orthogonal axes designated roll, pitch, and yaw, by use of 
eight reaction control thrusters. Thruster opening was controlled by the 
closed loop electronics. A supply of 14-1/2 pounds of nitrogen was stored in 
a spherical tank at 3500 psi. Ten pounds were budgeted for attitude control, 
and four for pressurizing the fuel and oxidizer tanks. The nitrogen was 
regulated to 19 psi for the thrusters and to approximately 200 psi for 
pressurizing the fuel and oxidizer tanks. The advantages of using space 
proven, off-the-shelf hardware were major factors in the selection of the 
nitrogen control gas system. The thrusters and regulator were modifications 
of those used on the Ranger and Mariner spacecraft. 

4.2 SUBSYSTEMS DESIGN REQUIREMENTS 

In addition to the general guidelines and constraints specified in section 
2.0 which apply to the G&C system as a whole, there were the following 
specific requirements imposed on the RCS. 


Subsystem Life 

Nitrogen Supply 

Attitude Control 
Reserve 

Velocity Control Pressurization . 
Ullage and Leakage 
TOTAL 

System Leakage 

First Month (including velocity control 
pressurization) 

Thruster Requirement 

Response 

On transport lag 
Off transport lag 
Cycles (endurance) 

Leakage 
Thrust Levels 


One Year 


8.0 

2.0 

4.0 

1.0 

15.0 lbs. 


<.06l lbs/month 
<.037 lbs/month 


<9.75 millisec 
<9.5 millisec 
> 100,000 

<2SCC/hr/ thruster 
.05 lb. pitch and yaw 
.028 lb. roll - in couples 
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TRANSDUCER WEIGHT 
TEMP. * .06 LB 
PRESS, » ,56 


THRUSTER WEIGHT 
SINGLE - ,23 LB 
TRIPLE - ,67 LB 


FIGURE 4-2 REACTION CONTROL SUBSYSTEM 
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Temperature 

Thruster body - other components 

Thruster nozzle 

Gas temperature 

Pulse width 

Recovery time of electronic driver 
Regulator 

Adjustable pressure 

Maintain pressure 

With inlet pressure 200 to 3820 psig 
and flow rates 0.5 to 2.0 SC5M 

Cycles - lockup to 2.0 SCEM to lockup 240,000 

Cleanliness 

Maximum particle size 5 micron metallic 

25 micron nonmetallic 

Assembled in class 100,000 clean room 

The thruster performance was based on a specific impulse of 68 sec 
using N 2 & as 70 F. This also was the basis of the conversion to 
amount of N^ S as required. 

4.3 DEVELOPMENT AND OPERATION 

Cold gas Nitrogen reaction control subsystems had been used on several space- 
craft prior to Lunar Orbiter. The Ranger and Mariner were similar applica- 
tions and the hardware experience and techniques developed on those programs 
were used wherever possible. However, it became apparent that the particular 
Lunar Orbiter specifications for environment and performance precluded the 
automatic approval of the hardware based on ” space proven" operation. Most 
items of hardware were required to< be completely re-qualified and documented 
in a formal manner. 

4.3.1 SUBSYSTEM DESIGN EVOLUTION 

The stringent leakage requirements, necessary to meet a one year life 
requirement, played a dominant role in development and operation of the 
RCS. Many of the design considerations and minor problems encountered in 
both the development and mission operations were related to leakage con- 
siderations. The use of brazed fittings for all the plumbing, except the 
connection of the N 2 tank, and the use of a cluster of 3 thrusters to reduce 
manifold plumbing, are examples of the influence of leakage requirements 
upon configuration. "Modular" construction of the reaction control system 
was used to keep plumbing lengths short and allow testing at the subsystem 
(module ) level rather than at the spacecraft level. Tests for leakage 
after installation on the spacecraft were accomplished using a mass spectro- 
meter to sense leakage by means of a helium tracer. Thruster leakage was 
determined by using a special fitting over the end of the thruster and 
collecting the gas. Stringent component and assembly cleanliness require- 
ments were imposed to keep contamination low and to help maintain the 
leakage requirement. Each component had to meet the requirement that 


35 to 85 F 
-300 to +300° F. 
-65° to 85° F. 

11.5 + .5 millisec 
1 millisec 


16 to 24 psig 
+ 1 psi 
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there be no metallic particles exceeding five microns in size and no 
nonmetallic particles exceeding 25 microns in size. Component assembly 
in a class 100,000 clean room was required and acceptance test procedures 
included a test for cleanliness of the components. By purging the com- 
ponents with a gas which was passed through a 1.2 micron filter and collected 
on a 0.8 micron filter, it was determined if the component met the above 
requirements. If any particle exceeding the requirements was found, the 
component was purged again until the specification was met. 

Several significant design changes occurred early in the RGS design phase. 

The original system proposal had two levels of thrust, a low level for 
attitude control and a high level for control during velocity maneuvers. 

In July 1964, a. decision was made to use a gimbaled engine mount, controlled 
by thrust vector actuators (this trade is discussed in section 5.0). This 
change, made primarily to reduce spacecraft weight, eliminated the need for 
the high level one pound thrusters located on the solar panels. It also 
eliminated the associated structural coupling with the reaction control 
loop as a potential problem. As part of the weight saving effort a common 
Np storage tank was selected to serve as the RCS gas supply, and as a 
source of pressurizing gas for the fuel and oxidizer tanks. The several 
advantages of combining the two systems were: (l) weight saving of one 

tank instead of two, (2) weight savings by sharing the nitrogen residuals 
and reserves between the systems, and (3) considerable flexibility between 
the systems was available, e.g., a squib valve was provided to isolate the 
velocity subsystem. This could be used after the final- orbit maneuver to 
conserve all remaining N 2 for attitude control (sufficient pressure remained 
in the velocity system to expel fuel and oxidizer in a "blow down mode" 
to accomplish a final engine burn to crash the spacecraft at the conclusion 
of the mission). The major disadvantage was the possibility of a severe 
leak in one system depleting the gas for the other system. If the attitude 
control system developed a leak it could not be isolated since the loss of 
attitude control was catastrophic on the mission. One requirement that 
resulted from a combined system was to specify materials in the attitude 
control regulator and thruster which were compatible with since all 

leakage back from the propellant tank could not be prevented. 

In the original proposal the low level attitude thrusters were located on the 
equipment mounting deck. Just prior to the preliminary design review the 
decision was made to move the thrusters to the engine mounting deck to improve 
lever arms and reduce nitrogen consumption, and to reduce plumbing lengths. 

At this time the thrust magnitude of the roll thruster was reduced from 0.05 
lbs, to 0.028 lbs. to improve limit cycle efficiency in the roll axis. 

4.3.2 THRUSTER DEVELOPMENT 

The reaction control thrusters were designed to meet the requirements stated 
in paragraph 4*2. The original design requirements on response were much 
tighter (e.g., 5 milliseconds "On" transport lag) than final requirements. 
During the design evolution, it became apparent that the thruster vendor 
could not meet the response requirements over the specified range of temp- 
erature- and voltage. Thruster control circuit design had to be modified to 
be compatible with thruster capability. Response time was set on the thruster 
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NOZZLE MOUNT! NG SCREWS 
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STAINLESS STEEL VALVE SEAT 
440 St S 21 OK SI 


METALLIC FLANGE SEAL (Original configuration) 


TEFLON NOZZLE GASKET (Original configuration) FLANGE COUNTING SCREWS (6 places) 
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to minimize the nitrogen consumption for limit cycle operation. Limit cycle 
rate goals were one-fourth of the design rate used for fuel budget calculations 
and one-tenth of the design rate as set by photo smear requirements. This 
conservative requirement was set to assure that the rate requirements would 
be met even with multiple pulsing of the control system. Limit cycle rates 
during flight were almost always below the rate equivalent of two minimum 
thruster pulses. When the rates were higher, the major cause was disturbance 
torques . 

Thrust level was sized by the attitude maneuver method and equipment. The 
spacecraft was maneuvered at 0.5 degree per second nominally and the reaction 
control thrusters had to be large enough to reduce this rate to zero in less 
than four degrees travel (gimbal limits of the gyro). 

In order to meet the stringent leakage requirements of 2 scc/hr and have 
long life with low leakage, hard metal-to-metal seat and poppet were used in 
the thrusters. The seat was 440 stainless steel and the poppet was a 
tungsten carbide. Very satisfactory performance was achieved with this 
design in both test and flight. 

Early in the program a leakage problem was encountered during assembly of the 
hard metal seats to the thruster body. The thruster design during that time 
period is shown in the bottom half of Figure 4-3. The leakage was being 
controlled by. adjusting the torque on six assembly screws. Due to the very- 
tight leakage requirement, minute distortions of the seat occurred resulting 
in leakage that exceeded specifications. The hard flange of the seat was 
modified to mate against a silicone flange seal as shown in the upper half of 
Figure 4-3. This redesign eliminated the original problem by sealing the 
seat without distorting it. 

One pitch and a pair of roll thrusters were manufactured in a welded cluster 
of three with common manifolding to save weight, reduce leakage, and 
reduce the number of alignments required at the spacecraft level. Problems 
were encountered with the cluster of thrusters. During the assembly welding 
process, contamination was generated which caused thruster leakage. In 
many cases only two of the three thrusters would meet the specifications 
during thruster checkout testing. This resulted in a great deal of rework 
and schedule delays. In addition if one of the three thrusters was out of 
alignment, specification on spacecraft assembly realignment of that thruster 
would usually compromise the alignment of the other two. 

In order to maintain moderate thruster valve temperatures, the body of the 
thruster was mounted inside the thermal shroud. In addition, an insulating- 
silicone gasket washer was used between the nozzle and the valve body which 
reduced the heat loss through the nozzle to deep space. By necessity, the 
nozzle was exposed to the deep space environment with a temperature range- 
of + 300 degrees Fahrenheit. During testing it was shown that the valve 
operated successfully at temperatures as low as minus .65 degrees F. Also 
to prevent the possibility of thruster freeze up, the nitrogen gas was 
required to be dry enough so that moisture would not precipitate from the 
gas at temperatures down to minus 65°F. 


55 



D2-114277-2 


4.3.3 THRUSTER CONTROL CIRCUIT 

The circuit to control opening of the thruster was physically located in the 
closed loop electronics portion of the flight Electronics Control Assembly. 

The "valve driver" controlled the thruster in response to error signals from 
the sun sensor or star tracker, inertial reference unit, and slewing 
amplifier. 

A "one shot" electronic drive circuit was incorporated in the valve driver 
electronics to avoid thruster chatter caused by the driver responding to 
system noise of insufficient duration to cause the thruster to fully open. 

By preventing thruster chatter the number of cycles would be reduced to 
extend the life of the thruster for the one year mission. The on time of 
the "one shot" was selected to satisfy two conditions, (l) with worst case 
tolerances the thruster would be fully open prior to the one shot off time, 
and (2) minimum value consistent with the thruster response time to minimize 
the impulse bit capability of the system. In order to reduce the thruster 
off delay and protect the transistor drive circuit from excessive inductive 
kickback, a shunt zener diode was incorporated. The zener breakdown value 
was "optimized" as shown in Figure 4* -4 so that the off delay matched the on 
delay. The minimum impulse bit from the thruster with the one shot was 11 
milliseconds nominal. 

Current and voltage oscillograms were used to indicate actual physical motion 
of the valve plunger. A typical current trace for valve opening is shown in 
Figure 4~5a and for a valve closing in Figure 4-5b. These "signatures" 
were used to measure response time on component tests as well as to prove 
that the thruster was still functioning when installed on the spacecraft. 

4 . 3.4 REGULATORS 

The pressure regulator was designed to maintain a thruster supply pressure of 

19.5 psig + 1 psi from a maximum tank pressure of 3820 psig. The 3800 psi 
tank pressure was chosen near the- maximum value that an available space 
proven pressure regulator could tolerate without a redesign. The 19.5 psig 
thruster pressure was chosen to give a good thrust coefficient while maintain- 
ing a compact unit and meeting the thrust requirement. The maximum pressure was 
kept as low as possible under the above design constraints to reduce leakage 
and ullage. In order to relieve downstream pressure surge resulting from the 
slam start, a relief valve was incorporated in the regulator. The slam start 
resulted from firing the pressurization squib following spacecraft separation. 

4.3.5 PLUMBING 

Stainless steel quarter-inch tubing was used for the plumbing. The quarter- 
inch tubing was of adequate size to allow flow for a single thruster operation 
without excessive pressure drop. Because the spacecraft was maneuvered about 
one axis at a time, only a single thruster would operate for a long duration 
(not in a pulse mode) at a time. The quarter -inch tubing had pressure drops 
which resulted in out of specified thrust if all three thrusters were 
operated simultaneously. Since this mode of operation was not normal and the 
reduced thrust caused by three thruster simultaneous operation was still 
adequate for control, the tubing size was not increased. 
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To keep leakage to a minimum the joints were brazed. Stainless steel tubing 
was chosen because consistently good brazed joints were easier to achieve. 

The brazing process was chosen over welding because the plumbing could be 
assembled and brazed on the spacecraft without contaminating the system. 

4.3.6 TESTING 

Engineering evaluation tests of the thrusters were conducted using development 
models of the thrusters with sea-level nozzles obtained from Sterer in August 
of 1964. These were later incorporated on the air-bearing attitude control 
simulator. 

One of the major questions about the reaction control subsystem from the 
critical design review of January 1965, was whether the specific impulse was 
degraded in the minimum pulse or limit cycle mode of attitude control. 

An analysis was conducted to assess the total impact on the N 2 gas requirements 
of a specific impulse degradation. The analysis indicated that the gas require- 
ments for short pulsing were relatively insensitive to I gD over a range from 
45 to 68 sec. The reason for this was that gas required for limit cycle went 
down with lower I g p while the gas required to remove disturbances went up. 

The two effects tended to cancel out. 

In addition, a simple unique method for testing valve thrust and impulse 
degradation was devised. The test thruster was mounted at the end of a 61 
inch piece of l/4-inch tubing as a cantilevered beam which had a free period 
of 1.0 sec. (See Figure 4-6). Due to the low damping of this system, the 
first peak or the steady state value of the deflection is proportional to 
thrust level. Steady state thrust levels were measured using this test set 
up. In addition, the same test set up was used to determine impulse when 
the thruster was driven by single pulses of 5 to 100 milliseconds duration. 

As a result of this testing, it was concluded that there was no significant 
impulse degradation due to short pulsing. These were some of the tests 
which added confidence in the 'adequacy of the design. 

During spacecraft level testing the thrusters were operated for several 
thousand cycles without gas flow. Throughout spacecraft testing, when the 
spacecraft was not in a clean room area, the thrusters were kept clean by 
means of a dust cover over the end of the thruster. As a result, only 
internally generated conatmination could cause the thrusters to exceed 
their leakage requirements. By cycling the thrusters several thousand cycles 
with N 2 flowing, the leakage could be reduced to an acceptable value, <3 scc/hr. 
The hard metal poppet and seats and gas flow would eliminate any contamination 
without scoring and return to an acceptable leakage state. This was a very 
useful advantage of the metal to metal seat design. 

4.3.7 MISSION PERFORMANCE 

The Lunar Orbiter Mission Operations proved to be very flexible, in part due 
to an adequate supply of nitrogen control gas. The requirement to provide 
the capability for control of the spacecraft for one year provided a sub- 
stantial amount of N 2 that could be traded for modifications to the primary 
(30 day photographic; mission. 
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Figure 4-6: REACTION CONTROL THRUSTER FORCE AND IMPULSE TEST SETUP 
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During Mission I, an internal leakage did occur in the velocity subsystem 
regulator . In ten days approximately one pound of Ng vented overboard ■ 
through the propellant tank pressurization relief valve. A decision to 
isolate the system even though there was propellant left was made to con- 
serve the attitude control nitrogen. The isolation squib stopped the major 
leak. Later the velocity control engine was fired successfully in a blow 
down mode. Following the photographic mission (30 days into the flight), 
a detail analysis was made to account for all control gas used. The difference 
between the actual usage (as indicated by telemetry pressure and temperatures) 
and this impulse analysis was 50 scc/hr. Leakage through the isolation squib 
of the velocity control subsystem was not evident in tank pressure rise. 

Since the analysis only covered 2 orbits, approximately 7 hours, the leakage 
value is at best an estimate due to the coarseness of the telemetry data 
and inaccuracy in assessing the nitrogen used in the limit cycle mode. The 
significant thing is that the design leakage requirement was based on approxi- 
mately 21 scc/hr with the isolation squib completely closed. 

Performance during Mission II was as expected. The first clear evidence of 
leakage through the velocity control isolation squib was indicated by the pro- 
pellant tank pressure rise after the isolation squib was blown. Methods of 
conserving nitrogen gas were improved and refined. 

Figure 4-~7 is a comparison of the design nitrogen budget and the Mission III 
actual usage. It is evident from the comparison that the basic photographic 
mission was greatly expanded from the design mission by comparing the design 
and actual photo maneuvers. Also, an additional 1.1 pound of nitrogen was 
used to circumvent problem areas encountered with the spacecraft. It is 
evident from Lunar Orbiter experience that the control propellant budget 
for future spacecraft should include contingency gas. • 

During the last four of the Lunar Orbiter missions there was a small internal 
leakage through the velocity subsystem isolation squib. The leak was esti- 
mated to be 50-100 cc/hr and occurred until the velocity control regulator 
went to "lock up" and then thd leak stopped. An improved design of this 
isolation squib with a conical shaped plug and seat, rather than a cylin- 
drical shape would probably have reduced this leakage source. 

There were no catastrophic failures of any of the components during the 
five Lunar Orbiter flights which accumulated 920 days of flight time in the 
five flights. A summary of thruster cycles and total mission time is pre- 
sented in Figure 4- -3. 

4.4 CONCLUSIONS AND RECOMMENDATIONS 

The major conclusions of the study of the Lunar Orbiter Reaction Control 
design are: 

l) The cold gas Ng reaction control proved to be highly reliable, and 
with operating characteristics closely predictable.. There was never 
any evidence in flight that the delivered specific impulse differed 
from the theoretical value of 68 to 70 seconds. 
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PRIMARY PHOTO MISSION (30 Days) 

Design 

Actual 


Budqet (Mission III) 

Initial Acquisition 

0.22 

0.30 

Attitude Maneuvers for Velocity Change 

0.55 

0.28 

Photo Maneuvers 

12-3 axis (design total) 

1.19 


41-3 axisi 
8-2 axis[ (actual) 
1-1 axis) 

Actual Total 


3.84 

Photo Transmission 

10 days (design) 

0.68 


8 days (actual) 


0.40 

Extra Maneuvers 

0.0 

1.11 

Limit Cycle & Automatic Celestial Reacquisition 

1.36 

1.07 


4.00 

7.00 

EXTENDED MISSION 



TOTAL (ll months design, 7 months actual). 

4.02 lbs 

3.7 

Usage Rate 

0.012 lbs/day 

.0172* lb/day 

Reserve 

1.98 

* 

Ullage 

1.00 


Available when destroyed 


1.0 

N Velocity Control 
2 

Primary 

4.00 

• 2.85 

Extended 

.0 

.65 

Total Velocity Control 

4.00 

3.50 

Total Supply 

15.00 

15.20 


^Average usage during 215 days. Included limit cycle and pitch maneuvers 
for thermal relief plus several special tests and training maneuvers for 
Mission IV. 


FIGURE 4.-7 DESIGN N 2 BUDGET 


Compared to Mission III Actual Usage 
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Mission 

I 


II 


III 


IV 


V 

s/c 

4 


5 


6 


7 


3 

Test Cycles 

697,380 


497,100 


231,500 


74,800 


96,400 

Photo Mission Cycles 

26,830 


15,260 


17,000 


19,180 


17,li0 

Extended Mission Cycles 

N. D. 


N. D. 


N. D. 


N. D. 


214,400 

Total Cycles 

724,210 


412,360 


248,500 


93,980 


327,910 

Cycles Per Thruster ^> 

120,700 

&> 

85,390 

0 

41,310 

&> 

15,660 

0 

54,610 

Flight Time Total 

79 days 
18 hrs 


338 days 
8 hrs 


246 days 
9 hrs 


73 days 
8 hrs 


182 days 
9 hrs 


N.D. - no data 

Total of test and photo mission cycles. 

Assuming each thruster operates approximately one sixth of the total. 


FIGURE 4.-8 THRUSTER CYCLE AND TIME HISTORY 
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2) Prevention of leakage for the long life requirement had the major 
impact on the design. Welding and brazing proved to be good solu- 
tions. Cleanliness requirements for contamination to be less than 
5 micron for metallic and 25 micron for nonmetallie particles was 
justified. Even so, the velocity control Ng pressure regulator 
experienced internal leakage (failing to lock-up completely) on 
Lunar Orbiter I and wasted approximately 1 lb. of gas. 

3) An adequate gas supply permitted the flight operations to be con- 
ducted with a flexibility greater than was anticipated at the 
design stage. 

4) A one-shot or minimum pulse bit command to the thruster is re- 
commended to avoid valve chatter problems. 

5) Hard metal valve seats are recommended for valves expected to last 
more than 6 months in space or operate more than 100,000 cycles. 

6) Combining the Np gas supply for reaction and velocity • control 
proved to be good on Lunar Orbiter and added to the mission 
flexibility. 

7) Valves or other moving parts tend to generate their own contamina- 
tion particles which may accumulate during testing and' cause ex- 
cessive leakage. The thruster valves on Lunar Orbiter proved to be 
self cleaning when Np gas was allowed to flow from a make-up supply 
during final spacecraft check-out. 

8) Thruster nozzles with external threads allow caps to be installed 
for protection and sealing. System regulator checks may also be 
performed without added test valves. 

9) Oscillograms of current and voltage provide an adequate signature 

of physical motion of the valve plunger for functional test purposes. 

10) The Np tank supply was sealed off from the reaction and velocity 
systems by squib valves until the squibs were actuated in space. 

This permitted end to end system testing from the time of final 
spacecraft propellant and Np tank loading until actual launch 
without being constrained by the amount of Np gas which would be 
wasted if the tanks had not been so isolated. This was a good 
feature and added confidence in proper hardware operation. 

Recommendations for doing differently "if one were to do it over" are; 

1) Welding of thrusters into a cluster of three caused problems with 
manufacturing and delivery schedule slides because the process 
caused contamination of thrusters previously completed satis- 
factorily. 

2) The isolation squib of the velocity control system was inadequate - 
it leaked 5 it could not be actuated against normal system pressures 
early in the mission. A conical seated squib valve should have been 
used. 


64 



D2-1 14277-2 


5.0 THRUST VECTOR CONTROL SUBSYSTEM 

The Thrust Vector Control (TVC) subsystem is one of four subsystems that 
constitute the spacecraft G&C system. The relationship of the TVC sub- 
system to the total G&C system is illustrated in Figure 5.-1. 

5.1 SUBSYSTEM DESCRIPTION 

The TVC subsystem, illustrated in Figure 5.-2, consisted of 3 principal 
elements for each axis, the thrust vector actuator, the gyro, and the 
compensation network. The TVC subsystem controlled the spacecraft pitch 
and yaw attitude during velocity maneuvers. The Attitude Control Subsystem 
initially oriented the spacecraft to the attitude desired for the thrusting 
maneuver, and established a 0.2° deadband. During the velocity maneuver, 
error signals from the gyros operating in the rate integrate mode, commanded 
actuator position through the lead-lag compensation networks. The velocity 
control engine was mounted on a set of gimbals and positioned by the thrust 
vector actuators. The gimbal assembly utilized flexural pivot bearings, 
which were selected because of their inherent insensitivity to prolonged 
space storage, and ability to withstand high temperature resulting from 
engine heat soakback. The compensating networks were located within the 
closed loop electronics portion of the flight electronics control assembly. 
Roll control was maintained by the .028 lb. roll thrusters of the Reaction 
Control Subsystem. The pitch, yaw and roll reaction control deadbands 
were opened to + 2.0° during engine firing to avoid wasting reaction control 
gas. 

5.2 DESIGN REQUIREMENTS 

In addition to the general guidelines and constraints specified in section 
2.4 and 2.5 that apply to the G&C system as a whole, there were the follow- 
ing specific requirements imposed on the TVC subsystem: 

Orient and hold the thrust vector with a total error of 1.3° 
(including attitude control two axis maneuver errors). 

Maintain control with c.m. offsets from actuator 

null of 1.5° 

Recover from engine start burn misalignment 
conditions : 

Full propellant tanks 3.8° 

Near empty propellant tanks 3-0° 

Have 6.0 db gain margin for all flight conditions. 

Environment: 

Pressure from sea level to hard vacuum 
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Operating temperatures 35° to 85°F. 

Actuator rod end soak back - 
non-operating 175 F. 

Vibration - A combination of 10.0 g sinusoidal between 20 
and 2000 cps and random vibration with a power 
spectral density of 0.02 g 2 /cps between 15 and 
400 cps peaking to 0.1 g^/cps between 1000 and 
1400 cps at 11 g RMS overall for Flight Acceptance 
Tests. Qualification tests were similar to FAT, 
but with 16 g RMS random for 4 minutes per axis 
and 15 g sine sweep at 4 octaves per minute. 

The requirements to cope with a c.m. offset and mistrim were based on two 
values of initial conditions, one a start-burn flight condition with full 
propellant tanks, and the second an end-burn flight condition with near 
empty propellant tanks. These initial conditions were: 


SOURCE OF MISALIGNMENT 

START BURN 

END BURN 

Initial spacecraft error with 
respect to the gyro null 

+ 0.2° 

+ 0.2° 

Initial actuator position 

+2.8° (stroke limit) 

+ 1.5° 

Engine position for c.m. alignment 

+ i.o° 

± 1.5° 

Initial nozzle angular error from 
trim 

3.8° 

O 

O 

« 

0 ^ 


The large c.m. offsets and shifts from trim used in the design were cal- 
culated from the effects of the possible propellant migration between tanks 
plus initial alignment tolerances. Actuator hard-over conditions were con- 
sidered for the start-burn flight condition because of the remote possibility 
that an actuator could overshoot to this condition if the velocity maneuver 
was short and the actuator power was shut off during an actuator high rate 
transient. A possible gyro error of + 0.2 degrees could exist at velocity 
engine ignition since these are the deadbands of the attitude control system 
prior to a burn. 

5.3 DEVELOPMENT AND OPERATION 

The thrusting control configuration originally proposed on the Lunar Orbiter 
spacecraft consisted of a fixed engine pre-aligned as close as possible to 
the average predicted center of mass. High thrust level (l.O lb) reaction 
control jets located at the tips of the solar panels were provided to maintain 
control of pitch and yaw during engine firing. The gimbaled engine config- 
uration was also considered and presented as a backup in the proposal. The 
high level reaction control was initially selected to avoid the problems of 
a new actuator hardware development. Early in the spacecraft design phase, 
total spacecraft weight dictated a vigorous weight reduction program. The 
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most important factors which favored the change to the gimbaled engine was 
the resultant weight reduction and allowed relaxation of c.m. location re- 
quirements. A tabulation of major trade factors are summarized in Figure 

5-3. 

A major engineering design decision was made based on this evaluation to 
change to a gimbaled engine using electromechanical actuators to provide 
pitch and yaw control during the engine burn. The decision made prior to 
the PDR permitted incorporation of necessary design changes and the develop- 
ment of a qualified actuator without a delay to the program. Problems 
arising during actuator development and subsequently in system integration 
did, however, cause delays in completion of qualification and reliability 
demonstration tests beyond initial schedules. The TVC actuators were the 
last items of the guidance and control hardware to receive qualification 
approval. 

5.3.1 THRUST VECTOR SUBSYSTEM DESIGH EVOLUTION 

The design concept selected for the thrust vector control loop was based 
on booster control technology, except that aerodynamic forces were not 
present in space. The initial transient conditions of engine thrusting 
direction relative to c.m. alignment were most important in sizing the 
actuator rate requirement for closed loop stability. The inability to 
predict c.m, location was due primarily to uncertainty in knowledge of 
where the propellant was located in the paired tanks during flight. 

Two potential problems with c.m. shifts due to unequal propellant in the 
paired propellant tanks were considered in the TVC subsystem design. The 
first problem results from propellant flow imbalance during the velocity 
maneuver. Small imbalances in tank pressures or in outlet pressure drop 
could result in one propellant tank depleting before the other. Since it 
could not be proved that the flow imbalance would not occur, matched 
orifices were installed in tank outlet lines and were sized to be the 
predominant pressure drop iii the propellant feed system which assured 
that propellant (both fuel and oxidizer) usage from paired tanks would be 
nearly equal. The second problem was possible migration of propellant from 
one to the other between the paired tanks during the long coast times be- ' 
tween the engine burns. It could not be proved that migration would not 
occur, so the TVC subsystem was designed to recover from the predicted c.m. 
shifts due to this phenomenon. 

Another problem which strongly influenced the TVC subsystem development was 
the inability to precisely model the spacecraft dynamics or the actuator 
dynamics while both were being designed and constructed. The approach taken 
was to keep the design as simple as possible while maintaining a conservative 
approach of considering worst case situations for those parameters that 
could not initially be definitely specified. 

Early in the thrust vector design, an attitude trimming network was con- 
sidered. A simple block diagram of this network is shown in Figure 5.-4. 

The output of this network was summed with the gyro position. Since the 
actuator must align the thrust vector with the c.m. for a trimmed condition, 
a steady offset of the thrust with the spacecraft centerline results. The 
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ADVANTAGES OF GIMBALED ENGINE 


DISADVANTAGES OF GIMBALED ENGINE 


1. Weight Savings - 20 lbs. 

2. Eliminates Skewed High Thrust Control 
Axes Due to Thruster Location on Solar 
Panel. 

3. Eliminates Reaction Control Coupling 
with Solar Panel Flexibility 

4. Eliminate Flexible Plumbing to Panel 
Mounted Thruster. 

5. High Level Thruster Valve Location 
Problem Eliminated. 

o Performance is Best With 

Thrusters on the Tip of Solar 
Panels 

o Solar Panel Temperatures are Extreme 

6. Simplify Reaction Control System 
Mechanization and Allow Modular Design. 

7. Mission Performance Less Sensitive to 
C. M. Change. 

o Relax c.m. Control Requirement 

8. Gimbal System Provides Better Growth 
Capability. 


1. Actuator Development Required - Time Short 

2. Structural Redesign to Provide Gimbaling 
Compatible with: 

- Space Environment 

- Engine Heat Soakback 

3. Actuator Development and Qualifications 
Cost is a Major Addition. 

4. Introduces TVC Coupling With Solar Panel 
Flexibility. 


FIGURE 5-3 TRADE BETWEEN GIMBALED ENGINE CONTROL AND NITROGEN THRUSTER CONTROL 
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FIGURE 5-4 ACTUATOR WITH TRIM NETWORK 
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trim network had a long time constant but would eventually cause the space- 
craft centerline to move away from the initial thrusting orientation so 
that the resultant thrust vector would align itself with the nominal desired 
direction. This network was discarded because it increased the system 
complexity and reduced reliability. Also, it reduced over-all system 
stability margin for a given compensation design since this feedback was 
positive. 

5.3.2 SUBSYSTEM ANALYSIS AND SIMULATION 

Thrust vector control subsystem analysis and analog computer studies were 
initiated early in the design phase of the program to define component and 
system performance requirements. Initial analyses and computer simulations 
prior to the CDR were based on a simple structural model with variable hinge 
stiffness of each appendage. Later analysis refined the model to include 
flexible body parameters as determined from structural dynamic model tests. 
Linear and non-linear structural effects with propellant slosh were evaluated 
on the analog simulation. 

Even though damping effects of the propellant expulsion bladder was not in- 
cluded (a conservatism assumption), slosh dynamics were found to be in- 
significant compared to structural coupling associated with the solar panels 
and antenna booms. Qualitative estimates of the slosh damping provided 
by the bladders was estimated to be .2 to .3 by observing movies of those 
dynamic tests. It is also significant that all of the propellant was 
located between the engine and the spacecraft center of mass and divided 
among four tanks. This was an ideal arrangement from a slosh stability 
standpoint. 

During the design phase the analog simulation was used to determine com- 
pensation requirements, system response, transient response, etc. Early 
in the design phase, actuator characteristics (i.e., nonlinear effects) 
were simulated in detail to determine effects on system performance. From 
the analog simulation, detailed actuator requirements were generated so 
that overall system requirements and stability could be met. Close coordi- 
nation between the TVC subsystem analyst and the actuator vendor was re- 
quired during actuator development to keep the analog simulation up to date 
and evaluate effects of actuator design changes on system performance. 

5.3-3 THRUST VECTOR ALIGNMENT 

Compensation for known pre-launch, center of mass offsets was accomplished 
by aligning the thrust vector with the known c.m. using a mechanical adjust- 
ment in the actuator length prior to flight. During the adjustment the 
actuator was set at its electrical null. This procedure would reduce 
pointing error required to align the thrust vector through the c.m. Since 
the thrust vector was not aligned with the spacecraft centerline after these 
adjustments, the attitude maneuvers were adjusted to compensate for this 
known offset. 

In order to reduce startup transients at each engine ignition, the actuator 
was designed to be irreversible and the electrical power was switched off 
the actuator between velocity maneuvers. During each velocity maneuver 
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(if the maneuver was of long enough duration) the actuator aligned the 
engine thrust vector through the center of mass. At the next velocity 
maneuver the engine would be trimmed up with the c.m. , providing there 
was no change, and the resulting transient minimized. This technique 
increased the stability margin since the system stability was a function 
of initial conditions because of actuator nonlinearities. 

5.3.4 COMPENSATION NETWORK SELECTION 

Structural design of the Lunar Orbiter solar panels, communication antennas 
and the deployment mechanisms resulted in a significant amount of structural 
coupling with the TVC subsystem. The structural frequency of the appendages 
was between 2. and 3.5 Hz and was primarily the result of the deployment 
and hinge mechanism. The rigid body control frequency was between 0.4 and 
0.6 Hz. Analysis also indicated that the structural coupling was a maximum 
with frequency separation between the appendages of about 20$. The structural 
coupling was accentuated by the engine start up thrust exciting the 'appendage 
oscillations. Differential frequencies between the appendages resulted in 
asymmetric (out of phase) oscillations which were sensed by the gyro and fed 
into the thrust vector loop. Because of this coupling, dual lead-lag 
compensation was employed to phase stabilize the structural frequencies. 

A high forward loop gain was required with the position actuators to reduce 
system droop and meet system pointing accuracy requirements. As a result 
of dual lead-lag and high forward loop gain, significant noise problems 
were encountered during the design. Subsequently, changes in this com- 
pensation were made to reduce the actuator command signal noise to a tolerable 
level by adding a double lag filter to attenaute high frequencies. A re- 
duction in forward loop gain caused a slight increase in pointing error but 
this was acceptable based on system analyses. Noise filtering was also added 
to the actuator itself to reduce the noise levels. 


5.3.5 ACTUATOR 

The gimbaled engine configuration with thrust vector control required an 
electromechanical actuator to be developed for a hard vacuum environment. 
(Refer to section 8.5 for a design review summary of the actuator). A 
position actuator rather than a rate actuator was chosen for the TVC design 
because: (l) simpler compensation in the forward loop was possible with a 

position actuator, (2) precision position feedback was easier to implement 
in the actuator, ( 3 ) a position actuator eased the initial conditions for 
engine start up transients, ( 4 ) performance of the subsystem was easier to 
monitor and (5^ a position actuator simplified the interface between Boeing 
and the subcontractor. 

Approximately one month after the decision to use a gimbaled engine, the 
actuator procurement specification was released. During this time period 
the structural model was undefined and structural frequencies of 1.5 and 
1.65 Hz were assumed for the solar panels. The actuator frequency response 
limit was specified to be greater than the expected structural frequency. 
The stroke l imi t was determined by calculation of the maximum travel re- 
quired by the actuator to align the thrust with the center of mass and 
adding an additional 1.5 degrees of nozzle deflection for control purposes. 
The additional 1.5 degrees was determined on an analog computer to give 
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adequate control acceleration for system response. Rate limits were set 
high to assure adequate dynamic stability margins with mistrim conditions 
of two degrees and stroke limits of 2.5 degrees. Later these stroke limits 
were increased to the final value of 2.8 degrees. 

5.3.6 TEST 

Subsequent to the decision to gimbal the engine for thrust vector control, 
studies were initiated on a definition of a test and design verification 
program needed to demonstrate compatibility of the thrust vector control 
system when coupled to the spacecraft dynamic model. Consideration was 
given to various levels of hardware sophistication from an actual 6 degrees 
of freedom tethered spacecraft flight in a vacuum chamber, as had been done 
on the Mariner spacecraft, to. a computer simulation which was believed to 
be a m-irnmnm possible level. Because of program timing, it was apparent 
that serious consideration could only be given to doing the task at Boeing. 

A spacecraft level hot firing in a 19-foot diameter vacuum chamber was 
proposed to Program Management. A summary of significant considerations 
generated at that time is included in Figure 5.-5. A Management decision 
was made not to conduct a closed loop test of this magnitude. It was felt 
that the test could not be justified in view of added cost when considering 
the inaccuracy of results. Principal limitations of the- simulation were 
caused by gas flow disturbances in the chamber and effects of the suspension 
on the dynamics of the controlled spacecraft. The JPL conclusion derived 
from Mariner experience was that such a test served to corroborate analysis 
techniques. This provided added confidence in the decision. The program 
that finally evolved was accomplished by a series of separate tests. The 
first of these tests was a demonstration of actuator performance when 
installed in the development propulsion module to gimbal the engine during 
an actual engine firing in a vacuum test chamber. Acceptable actuator and 
gimbal performance in space environment was demonstrated by a series of 
open loop tests conducted during a simulated mission engine firing sequence. 
These tests included a frequency response of the actuator servo loop to 
various amplitude input commands. 

Final subsystem evaluation and design verification of the thrust vector 
control subsystem was demonstrated during the closed loop test program. 

For this test, actual thrust vector control hardware as shown in Figure 
5.-6 was coupled to an analog simulation of the inertial reference unit 
and the spacecraft dynamics. Acceptable performance was demonstrated for 
all expected flight conditions except for the following: 

1. Actuator oscillation was experienced due to coupling between 
the actuator and control electronics. This development problem 
was corrected by modification to actuator electronics and adding 
filtering to the TVC compensation network. 

2. Gain margin was only 3.6 db for conservatively assumed struc- 
tural damping of .01. Actual damping was subsequently 'esta- 
blished by test to be at least .03. Gain margin for this 
condition exceeded the required value of 6.0 db. 
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1. The effect of engine vibration and the resultant control system noise generated by the inertial 


reference unit and amplified by the control 
acceptable system performance. Pro and Con 
vacuum chamber are presented. 

PRO 

a. A vacuum chamber spacecraft firing 
test is best, next to actual space 
flight firing, it would includes 

o Engine thrust characteristics 
o Actual S/C with flexibility and 
dynamic coupling 
o Fuel Slosh 

o Power supply and wiring 
o Actual control performance including 
system interfaces, sensors, elect- 
ronics, actuation. 

b. Superposition holds for linear items 
only, presence of all effects at once 
may cause separation. 

c. Non-linear effects have not been fully 
analyzed. 

d. A complete simulation of the system 
could become more complex, difficult, 
and time consuming than to do the 
closed loop test using actual hardware. 

2. Results of 6 degree of freedom tests of the 
precedent. 

PRO 

o Such tests are planned for future 
spacecraft developed for JPL because 
"yielded information unobtainable by 
other means." 


electronics must be investigated to demonstrate 
arguments of a spacecraft level live firing in a 

CON 

a. Chamber test and suspension have limitations 
which will modify vehicle response. Proposed 
test suspension was constrained to limited 
freedom in 2 translations and 1 rotation. 
Engine exhaust would impinge on solar panels 
and high gain antenna. 

b. Work around methods can be employed to 
investigate each problem separately. 
Superposition holds, therefore individual 
examination is valid. 

c. Analysis methods for problems are established, 
proven valid by past programs. 

d. Analog simulation can produce better and 
cheaper answers. 


Mariner S/C in a vacuum chamber provide a significant 


CON 

o It was concluded that test results 
corroborated the analytical approach. 


FIGURE 5-5 THRUST VECTOR CONTROL 
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Figure 5-6: CLOSED-LOOP TEST OF THRUST VECTOR CONTROL SYSTEM 


76 





D2-114277-2 


3. Command signal electrical noise caused actuator power to 
exceed allowable values. In addition to the compensation 
filtering, the actuator electronic switching deadband range 
was increased to provide additional safety margin. 

Closed loop test results verified that analog simulation of the actuator 
dynamics was very good, and close correlation between results with analog 
and test actuators were obtained. 

5.3.7 MISSION PERFORMANCE 

In the five Lunar Orbiter missions the velocity control subsystem was 
operated a total of 29 times, 16 being in direct support of the primary 
photographic mission and the remaining 13 being conducted during the 
extended mission. Although the design operating life requirement for the 
Thrust Vector actuator was 18 days, successful performance was demonstrated 
during engine firings as long as 338 days after launch. Figure 5.-7 
summarizes all velocity maneuvers. Figure 5 .-8 summarizes the operational 
experience. 

Thrust vector control performance in terms of actuator position telemetry 
data is shown in Figure 5 .-9 for both actuators of typical flight space- 
craft. These data show that equal propellant flow did occur during all the 
engine burns and there was no migration during the static periods between 
engine firings. 

Flight verification via telemetry of thrust vector short period dynamic 
response and stability margins could not be made. Telemetry sampling rate 
(l sample every 23.04 seconds) was too slow to assess the transient behavior 
of the system.- The only indication from flight data of thrust vector 
dynamics and stability were the residual spacecraft rates following engine 
shutdown. For all the velocity maneuvers, the residual spacecraft rates 
were very low, indicating gpod stability of the thrust vector system. 

5.4 CONCLUSIONS AND RECOMMENDATIONS 

The major conclusions resulting from the study of this thrust vector control 
system are as follows: 

1. The subsystem was more than adequate for the task and all 
flight results indicated excellent control and stability. 

2. Dual lead lag compensation of a position signal leaves the 
designer most susceptible to both electrical and mechanical 
noise problems . 

3. Structural appendages should have a frequency separation of 
approximately 5 to 1 above the rigid body controlled frequency. 

4. Structural frequency separation between appendages is a 
critical parameter to the TVC subsystem. Design specifi- 
cations should keep separation either very small ( < 10$) 
or large ( > 50$). 
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TVC 



PLANNED 

ACTUAL 

ADDITIONAL 

OPERATION DAYS 



f> 



AFTER LAUNCH 

REMARKS 

L. 0. I 

4 

5 

o 2nd Orb Trim 

15 

Lower Photo Altitude 




o Impact 



L. 0. II 

5 

7 

o Inclination Change 

30 

L. 0. Ill Selenodesy 




o Orbit Phasing 

157 

Solar Eclipse 




o 2nd Orbit Transfer 

231 

Life Time Adjustment 




o Impact 

338 


L. 0. Ill 

5 

7 

o Orbit Phasing 

67 

Solar Eclipse 




o Perilune Change 

162 

Apollo Type Orbit Adjustment 




o Apolune Change 

207 

Apollo Type Orbit 




o Impact 

246 


L. 0. IV 

3 

4 

o Perilune Change 

32 

L, 0. V Selenodesy 




o Apolune Change 

35 

L. 0. V Selenodesy 

L. 0, V 

6 

6 

o Orbit Phasing 

70 

Solar Eclipse 




o Impact , 

182 


TOTAL 







23 

29 




]l> 2 MIDCOURSE, ORBIT INJECTION, 

ORBIT TRANSFER PLANNED. 



ONLY ONE MC WAS 

REQUIRED ON EACH MISSION. IMPACT WAS 

ADDED REQUIREMENT AFTER L. 0. I 


FIGURE 5-7 VELOCITY MANEUVER HISTORY 
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SPACECRAFT 


L. 0. I - S/C No. 4 

Act. S/N 14 
Act. S/N 15 

L. 0. II - S/C No. 5 

S/N 16 
S/fo 18 


L. 0. Ill - S/C No. 6 

S/N 21 
S/to 22 


L. 0. IV - S/C No. 7 

S/to 23 
S/N 24 


L. 0. V - S/C No. 3 

S/N 17 
S/N 26 


OPERATING TIME 


ur i-uni j-ix vj 

GROUND TEST 

X JUVU_ 

FLIGHT 

TOTAL 

ACCUMULATED HOURS 

SEC 

HOURS 

HOURS 

237 

730 

.2 

237.2 

244 

730 

.2 

244.2 

207 

752 

.21 

207.2 

208 

752 

.21 

208.2 

39 

752 

.21 

39.2 

45 

752 

.21 

39.2 

9 

715 

.2 

9.2 

9 

715 

.2 

9.2 

25 

720 

.2 

25.2 

19 

729 

.2 

19.2 


* Prior to final operation 


FIGURE 5-8 OPERATING LIFE HISTORY - FLIGHT S/C 
THRUST VECTOR CONTROL SYSTEM 


VACUUM* 
EXPOSURE 
LIFE (PAYS) 


79 

79 


338 

338 

( 8100 hrs.) 


246 

246 


35 

35 


182 

182 
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LUNAR ORBITER I 



LUNAR ORBITER II ALSO TYPICAL OF III & IV 



LUNAR ORBITER V 



FIGURE 5-9 ENGINE POSITION TIME HISTORY FOR MISSIONS I THRU V 
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5. Use of an irreversible actuator to maintain the thrust vector 

. aligned with the c.m. during non- thrusting periods will reduce 
startup transients and improve stability margin with actuator 
nonlinearities. *■ 

6. Subsystem closed loop stability tests can be adequately de- 
monstrated by a hybrid simulation of spacecraft dynamics in 
a computer and actual hardware. 

Recommendations for "doing differently if one had it to do over" are: 

1. Interfacing impedance and electrical noise requirements should 
be specified to each component. 

2. Requirements for c.m. offset should be critically scrutinized 
and methods developed to support or invalidate claims such 

as "propellant migration" between burns. 

3. Other methods than requiring a completely irreversible actuator 
should be considered for pre-aligning the engine to CM for 
repeated burns. 
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6.0 VELOCITY CONTROL SUBSYSTEM 

The Velocity Control Subsystem (VCS) is one of four subsystems that con- 
stitute the spacecraft G & C system. The relationship of the VCS to the 
total G & C system is illustrated in Figure 6-1. 

6.1 SUBSYSTEM DESCRIPTION 

The VCS, illustrated in Figure 6-2, consisted of the following: (l) a 

pulse integrating pendulous accelerometer (physically located in the 
inertial reference unit), (2) a velocity summer and magnitude comparator 
(part of the programmer, ) and (3 ) switching assembly to operate the engine 
propellant valves. The function performed by the VCS was control of the 
magnitude of the velocity maneuver. The accelerometer measured the space- 
craft longitudinal acceleration and generated a series of pulses with each 
pulse equal to a velocity increment of 0.1 ft/sec, which were summed by 
the flight programmer and compared to the commanded velocity change. At 
the instant the "integrated" acceleration was equal to the commanded 
velocity change the programmer issued a command to the switching assembly 
which switched off the power to the engine solenoid valves completing the 
velocity maneuver. 

The 0.1 ft/sec per pulse scale factor was chosen to allow an accelerometer 
saturation level of 0.6 g's with the 200 pulse per second repetition rate 
which the accelerometer employed. The accelerometer had two lines with a 
pulse repetition rate of 100 pulses per second on each line at zero accelera- 
tion. The AV was the difference in pulses between the two lines which re- 
quired an "up-down" counter in the flight programmer to feed the progra mm er 
counter with plus velocity pulses only. The programmer was designed to have 
the capacity for a velocity maneuver of 3276.8 ft/sec (998.7 meters/sec) 
with the acceleromet er sc ale factor of 0.1 ft/sec per pulse. 


6.2 DESIGN REQUIREMENTS 

The guidance concept dictated that the velocity magnitude be controlled on 
board the .spacecraft in a closed loop manner based on measuring the 
velocity change made good. A timed burn, for example, was not predicted 
to be accurate enough. The two critical AV maneuvers were (l) lunar orbit 
injection and (2) orbit change to final photo orbit perilune to an accuracy 
of + 5-5 km (out of 46 km nominal perilune altitude). The consequences of 
a gross error in AV magnitude would have been a failure to achieve a useful 
orbit or a crash of the spacecraft on the moon. 

Several "state-of-the-art" integrating accelerometers used on missile pro- 
grams appeared to be easily able to meet the accuracy requirements. Since 
the thrust to weight ratio of the Lunar Or biter ranged from l/9 to l/5 "g", 
(an uncommonly low "g" level) the scale factor needed to be sized for this 
particular application. 

The strong desire to use an existing off-the-shelf accelerometer caused the 
detail requirements for the VCS to be based on what could be obtained. The 
approach was to perform an error analysis for the subsystem using the vendor 
provided performance capabilities' and to compare this with the mission 
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requirements, final error analysis values obtained were 0.062 meters/ 
second plus 0.0018 A 7 for the lunar orbit injection. The primary con- 
tributors to the error in decreasing order were: l) accelerometer, 

2 ) programmer, 3) engine tail off. 

The initial null bias specification for accelerometer error was set at 100 
micro-" g" which was the "quoted" capability of an off-the-shelf unit. As 
the program progressed it became evident that the original requirement could 
not be met within the scheduled time and allocated cost. The accelerometer 
error specification was relaxed following an error analysis that’, showed 
that mission requirements could be met with the larger accelerometer errors 
including a null bias of 300 miero-g's. This relaxed error specification 
was used in the error analysis quoted above. 

The programmer portion of the velocity control subsystem was designed to 
the specific Lunar Orbiter requirements. The design specification of this 
unit required a computation accuracy of + 0.19 ft. per second for a 3000 ft. 
per second velocity maneuver and a resolution of 0.1 ft. per second. 

6.3 DEVELOPMENT AND OPERATION 

In addition to the component level tests, a subsystem compatibility test 
was performed as part of each spacecraft test sequence. The test was 
accomplished by orienting the spacecraft to a known attitude in the 3 axis 
test stand with respect to the acceleration due to Earth's gravitational 
field so as to be in the operating range 1/9 to 1/5 g. This provided a 
precisely known value of acceleration acting upon the accelerometer to 
simulate a velocity maneuver and proved to be a very good end-to-end test. 

A failure analysis showed that failure to shut off the engine at the proper 
time was the most criti cal failure. This could have caused the spacecraft to 
crash on the Moon's surface or to deplete the fuel supply prematurely. The 
second most critical failure was not to ignite the engine at the proper time 
for lunar orbit injection. To preclude such gross errors from occurring, 
operational procedures were devised and used on each engine burn. The pro- 
cedure was to assure engine ignition by monitoring the telemetry link. Real 
time commands via the DSIF could have been used if required. Also for each 
engine burn a real time command was sent to terminate the burn at a time 
which would be after the accelerometer had terminated it with normal operation, 
taking into account all the tolerance and the delay between command trans- 
mission and execution. This procedure was used to insure an engine cut off 
if any failure occurred in the accelerometer or programmer magnitude com- 
parison circuitry. With this technique it was also possible to perform a 
timed burn if a failure in the system was discovered. During the 29 velocity 
maneuvers in five flights the velocity control system operated normally and 
the backup command was never needed. 

Although there was no direct way to measure the actual accuracy achieved 
for each velocity change maneuver, all indications were that the accuracy 
requirements were met. As measured on-board the spacecraft and read back 
via telemetry each delta velocity maneuver was within .1 ft/sec (one 
pulse) of the programmed value. The minimum programmed AV was 5.4 meters/ 
second (burn time of 3*0 seconds) on Mission I and was used to trim the 
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photo orbit perilune altitude. The maximum programmed A V was 829 meters/ 
second, on Mission II (a burn time of 611.6 seconds) for lunar orbit in- 
jection. In light of the total number of maneuvers performed by the L.O. 
velocity control system, the accuracy requirements could probably have 
been relaxed by planning additional engine .burns if this had been necessary. 

Two midcourse corrections were planned for each mission; however, the 
accuracy obtained with. the first correction in - each case was sufficient 
to preclude a requirement for a second correction. Additional information 
on accuracy can be inferred from the data contained in section 7.0 which 
discusses the total guidance concept. 

6.4 CONCLUSIONS AND RECOMMENDATIONS 

The VCS successfully used available off-the-shelf equipment. Of signifi- 
cant importance was the use of error analysis evaluation instead of holding 
rigidly to early specifications for the accelerometer. This approach is 
recommended when it is necessary to impose the constraint of using off- 
the-shelf equipment. Where possible it would be better to obtain mission 
error analysis results early enough to develop specifications based on 
mission requirements rather than vendor performance data. The capability 
to perform velocity maneuvers by ground command was also a desirable asset. 
Although the back up capability was never required, the capability was 
available which improved the flexibility of the system and improved overall 
probability of mission success. 
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7.0 GUIDANCE CONCEPT DESCRIPTION 

Lunar Orbiter guidance was accomplished by (l) determining the spacecraft 
state from ground tracking and - telemetry data, (2) calculating maneuvers 
to control the trajectory and to obtain photographic data, ( 3 ) transmitting 
to the spacecraft the guidance commands required to execute these maneuvers, 
and ( 4 ) determining the new state from ground tracking and telemetry data 
to ascertain that commands were properly executed. 

7.1 GUIDANCE REQUIREMENTS 

Firm numbers for the guidance and control system hardware were not available 
during the formative design phase of the Lunar Orbiter program. The hard- 
ware development evolved along the lines of "do the best you can" within 
the state-of-the-art for this equipment. The reason for this approach was 
that the end result was photographic coverage of 1 meter or better re- 
solution of the lunar surface and with both forward and side overlap of at 
least 5$. Resolution was a function of many different variables. Given 
a nominal mission, the resolution degradation effected by a change in one 
parameter at a time could be determined. Although this gave a feel for the 
sensitivity of a change, very few were truly independent. At the time of 
submittal of the proposal, such a set of state-of-the-art hardware para- 
meters were postulated to yield a system giving satisfactory end results. 

In the time period between contract go ahead and preliminary design review, 
the hardware specifications were written based on the proposal numbers 
generated earlier and further analyses allocating errors to individual 
components where necessary. 

Some tolerances were set in an arbitrary manner because they could be 
achieved with little added cost. 

Late in the program, just before the first flight, a comprehensive error 
analysis was made. Several components could not meet their specifications, 
for example the IRU drift rate on LO I was 1 /hr. The requirement was 
waived on the basis of this analysis because the impact was extremely small 
and could be made up in altered operational procedures. • 

7.2 SPACECRAFT STATE 

A knowledge of the spacecraft state is required prior to the calculation 
of the guidance maneuvers. The spacecraft state is defined by position, 
velocity and attitude and is determined from ground tracking and telemetry 
•data. 


The position and velocity of the spacecraft were determined by tracking the 
spacecraft transponder radio frequency signals using the deep space tracking 
network. The doppler tracking data was processed and used by an orbit de- 
termination computer program to generate a spacecraft state vector. Basi- 
cally, the problem was to determine the trajectory which best fit the track- 
ing data over a given data arc. The output of this program was the space- 
craft state vector; the three components ' of position and the three components 
o^^eloci.ty, .at. ^ -given time-.., A more, complete discussion of .the orbit d«- 
teminatipnj problem, .is (beyond jthe . s.cppe .of .this.. report . 
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The attitude of the spacecraft was defined relative to the Sun and Canopus. 
Maneuvers away from the celestial references were in the gyro coordinate 
system. Each spacecraft was measured for alignment of the Sun sensor, 

Canopus tracker, inertial reference unit, camera optical axis, high gain 
antenna, and center of mass. All of this data was used to generate the 
desired precise maneuver commands. When gyro drift was a factor because 
of the time off celestial references, it was also taken into account. 

7.3 CALCULATION OF SPACECRAFT MANEUVERS 

When the spacecraft state was known, the required maneuvers were calculated 
to provide for the accomplishment of the mission objectives. These 
maneuvers were velocity control maneuvers required to change the trajectory 
and photographic maneuvers required to obtain the desired photographic 
coverage. Attitude maneuvers were also required for subsystem operation 
such as for thermal control and for star maps but are not discussed here 
because they were not guidance maneuvers. 

7.3.1 VELOCITY CONTROL MANEUVERS 

Velocity control maneuvers were required at midcourse, at orbit insertion, 
and in orbit for orbit adjustments. These maneuvers were calculated using 
Flight Operations Orbit Determination software at the Space Flight Operations 
Facility and were also calculated independently at the Seattle Operations 
Center using mission design software. The calculation of the maneuvers con- 
sisted of the determination of the time of the maneuver and the magnitude 
and direction of the corrective velocity vector. (Maneuver angles were then 
calculated to rotate the thrust axis from the celestial reference to the 
required orientation. ) These velocity control maneuvers were calculated in 
accordance with mission control criteria which were defined by pre-flight 
mission design. These criteria defined the desired end conditions and allow- 
able control tolerances on each parameter. A typical set of these desired 
end conditions and tolerances is contained in Figure 7.-1. 

The FLight Operations software was designed to provide for real time tra- 
jectory design. That is, a maneuver was calculated to satisfy some mission 
objective, rather than to correct the trajectory back to some pre-mission 
nominal. For example, in the calculation of the first midcourse maneuver, 
neither the lunar arrival conditions nor the initial orbit conditions were 
specified. Rather, the conditions over some photo site in the final orbit 
were specified and the post-midcourse trajectory was designed to satisfy 
these conditions. In forwarding the state vector from lunar arrival to 
the photo site, the Flight Operations software used for designing the 
maneuver was limited to the use of a relatively simple lunar gravitational 
model. As a result, some inaccuracies were incurred in the calculation of 
the initial orbit conditions which were used for design of the midcourse 
maneuver . 

A measure of the overall guidance accuracy is given in Figure 7-2. The 
trajectory parameters actually achieved following a maneuver are compared 
with the desired values of the parameters established prior to launch. The 
differences between the desired and the actual values are the errors in the 
overall guidance concept. These errors are due to (l) errors in knowledge 
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PARAMETER NOMINAL VALUE ALLOWABLE TOLERANCE ' LIMIT IMPOSED BY 


Apolune Altitude (km) 

1500 

100 

-100 

Nearside Resolution 
v/h, Farside Coverage 

Perilune Altitude (km) 

100 

10 

Nearside Resolution, 



-8 

30 Degree Cross-Track Tilt 

Orbit Period (hr) 

3.19 

+ 0.30 

+ 5 Deg. Cross-Track 
Tilt at V8A (lPl) 

Orbit Inclination (Deg.) 

85 

+0.6 Deg. 

+ 5 Deg. Cross-Track 
Tilt at 50 Deg. Latitude 

Argument of Perilune (Deg.) 

0.5 

+ 10 

Minimum V/h of 0.005 
Rad/Sec At 50 Deg. Latitude 

ASC. Mode Longitude (Deg.) 

71.41 

+ 0.28 

+ 5 Deg. Cross-Track Tilt 

True Anomaly (Deg.) 

0 

— 

— 

Time (S/C at Perilune) 

Aug. 9, 1967 + 2 hr. 

+ 1 Deg. Illumination 


Order of Preference of Solutions 

There may be several solutions with values within the allowable range of tolerances listed. If this is 
the case, it is desirable to get solutions with some of the parameters close to their nominal values. 
The order of priority of establishing nominal values is as follows: 


(a) Node Longitude 

(b) Orbit period 

(g) Apolune and perilune altitudes 


(d) Orbit inclination 

(e) Argument of perilune 

(f) Time at perilune 


FIGURE 7.-1 LUNAR ORBIT CONDITIONS AT START OF FINAL ORBIT 


MISSION V 
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LO 

I 

LO 

II 

LO 

III 

LO 

IV 

LO 

V 


DESIRED 

ACTUAL 

DESIRED 

ACTUAL 

DESIRED 

ACTUAL 

DESIRED 

ACTUAL 

DESIRED 

ACTUAL 

MIDCOURSE AV 

AIM POINT 
B.T. km 
B.R. km 

0 

6402. 

-1171. 

38 

6459. 

-1119. 

0 

6010. 

-391. 

21 

6o44. 

-373. 

0 

5005. 

-2465. 

5 

5607. 

-2479. 

56 

709. 

9755. 

61 

726. 

9808. 

5 

385. 

5701. 

30 

352. 

5696. 

ORBIT INJECTION AV 

796 

790 

831 

830 

705 

704 

655 

660 

645 

643 

Perilune Alt . km 

Apolune Alt . km 

Orbit Inclin. deg. 

Argument of Perilune 
Node Long. deg. 

200 
1650 
12 .04 
182.4 
326.1 

188.9 

1835.5 

12.16 

180.2 

215.4 

200 

1850 

11.95 

164.41 

341.2 

196.1 

1871.4 

11.94 

161.71 

341.65 

200 

1850 

21.0 

175.73 

211.41 

210 
1801. 6 
19.9 
174.43 
310.00 

2700 

6110 

85.5 

0.04 

131.0 

2706.3 

6114.2 

85.54 

1.15 

131.03 

200 

6050 

85.05 

1.37 

117.76 

194.5 

6018.3 

85.OI 

1.55 

117.75 

1st ORBIT TRANS. AV 

26 

4o 

26 

28 

26 

51 



12 

16 

Perilune Alt . km 

Apolune Alt . lor. 

Orbit Inclin. deg. 

Argument of Perilune 
Node Long. deg. 

57.9 

1850 

12.04 
187.02 
233. 7 1 *- 

57.4 

1853.9 

12.0 

181.20 

234.00 

50.2 

1844.1 

11.91 

183.3 

273.6 

49.7 

1852.6 

H.89 

162.83 

273-3 

54.9 

1840.0 

21.05 

178.34 

257.93 

54.9 

1847.4 

20.91 

178.88 

257.86 


i 

I 

1 

1 

100 

6128.7 

85.00 

0.90 

95.90 

100.4 

6107.0 

84.67 

1.26 

95.90 

2nd ORBIT TRANS. AV 









234 

234 

Perilune Alt . kr.i 

Apolune Alt . km 

Orbit Inclin. deg. 

Argument of Perilune 
Node Long. deg. 







1 

| 

100 

1500 

85.0 

0.50 

71.38 

98.9 

1499.4 

84.76 

1.88 

71.38 


OTHER MANEUVERS 2 4 4 2 2 

(Hoc planned in detail 'before launch — used to trim orbit, adjust orbit to minimize effects of eclipses, and 
to crash spacecraft.) 


FIGURE 7-2 

MANEUVER PERFORMANCE 
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of state (orbit determination errors and attitude errors), ( 2 ) errors 
in forwarding the state (due primarily to the ■uncertainty in the lunar 
gravitational model), ( 3 ) off nominal conditions due to previous maneuver 
errors, (4) errors in calculating the maneuver, and ( 5 ) maneuver execution 
errors. The significance of this data is that it shows how well the guidance 
concept worked. There were additional velocity maneuvers made as noted dur- 
ing each mission, but they were not defined prior to flight, therefore no 
comparison can be made. These maneuvers were for additional orbit trims, 
orbit phasing maneuvers to reduce the effects of lunar eclipses, and maneu- 
vers made to crash the spacecraft. 

The procedures used for the different velocity control maneuvers will be 
discussed separately. 

Midcourse Maneuvers 

Midcourse maneuvers were required for two reasons; first to correct tra- 
jectory errors resulting from launch vehicle cut-off errors and second to 
retarget the trajectory to the required lunar arrival conditions for the 
specific mission objectives. Generally, the launch vehicle targeting 
commenced before the photographic objectives, and hence the lunar arrival 
conditions, were defined. Therefore, it was necessary to target the launch 
vehicle to a preliminary aiming point. In the case of Lunar Orbiter IV, 
the launch vehicle was targeted for an orbit inclination of 21 degrees, 
while the final mission design was for an orbit inclination of 85 degrees. 

With the state vector known at some reference time and the desired end 
conditions specified (in this case conditions at some time after insertion 
into lunar orbit), there was one specific maneuver for a given maneuver 
time and lunar arrival time. This is true because in forwarding the state 
vectors into lunar orbit, the minimum AV orbit insertion maneuver (impulsive) 
was used. The decision which had to be made then was when to make the 
maneuver and what arrival time to use. Generally,- the maneuver was made 
as late as possible while staying within the AV budget but not later than 
50 hours before lunar arrival to allow time for a possible second midcourse 
maneuver. The later the maneuver was made, the lower the arrival dis- 
persions but also the higher the maneuver AV. The AV budget was de- 
fined as follows: 

AV budget = A V available (nominal) - AV required for 

later maneuvers (nominal) - AV tolerances 

The AV tolerances included allowances for engine performance (l S p), 
fuel loading, and trajectory errors. 

The arrival time was selected to minimize AV (midcourse plus orbit 
insertion) while observing a constraint to provide for viewing by two 
tracking stations at lunar arrival. 

No second midcourse maneuver was necessary oh any of the missions as it 
was always possible to- obtain an orbit within the specified limits. 
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Lunar Orbit Insertion 


At the time the decision was made that there would not he a second midcourse 
maneuver, it had been determined that a satisfactory orbit could be obtained; 
that is, one which, was within the limits defined in the mission control 
criteria. Normally, the nominal design orbit could not be obtained because 
the approach trajectory was not exactly nominal. In the calculation of the 
orbit insertion maneuver, the criteria was to obtain the "best" orbit. The 
control criteria which were specified the nominal values and acceptable 
limits on each of the orbit parameters, and also the order of' priority of 
each of the parameters. The problem then was to compute a maneuver which 
would result in an orbit with the highest priority parameters at their 
nominal values while keeping all the parameters within their specified 
limits . 

The procedure used by flight Operations at. the SFOF is described as follows. 

A "desired" orbit was determined by assuming an impulsive maneuver. This 
was done by allowing -one of the orbit parameters to change to satisfy the 
impulsive maneuver's constraint of ellipse-hyperbola intersection. Generally 
the parameter of lowest priority was allowed to vary and a solution was 
obtained with the other four parameters at their nominal value. If the 
value of the variable was outside the allowable limits, additional solutions 
were searched for with other parameters as the variable. This procedure was 
continued until a satisfactory solution was obtained. The A V was also 
required to be within the A 7 budget, which was determined in a manner 
similar to that for midcourse. 

Once the "desired" orbit was defined, a finite burn orbit insertion maneuver 
was calculated to obtain an orbit as close to the "desired" orbit as possible 
In this calculation the four maneuver parameters (ignition time, burn time, 
and two attitude rotations) were used as variables to search on "desired" 
values for four of the - five parameters of the orbit. The fifth parameter 
never differed significantly from its "desired" value, so there was no 
problem in satisfying the control criteria. 

There were two limitations of the Plight Operations software that became 
evident during the Lunar Orbiter program. First, some of the orbit para- 
meters which were used in the software were not the same as those specified 
in the control criteria document. (The software was designed long before 
any control criteria were conceived). The target conditions used in the 
program for calculating the insertion maneuvers were given as perilune 
latitude and perilune longitude. The control criteria specified values 
and tolerances for node longitude and argument of perilune. The reason 
that these parameters were specified in the control criteria is that node 
longitude was a very critical parameter in that it reflected directly to 
illumination of the photo sites. On the other hand, argument of preilune 
could have relatively loose tolerances as it had only a small effect on 
photographic altitude. As a result, argument of perilune generally had a 
large tolerance and was also of the lowest priority in the control criteria. 
But because of the characteristics of the Plight Operations program, this 
parameter could not conveniently be treated as the free variable in the 
calculation of the orbit insertion maneuver. 
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The second limitation was that the Plight Operations software required 
an impulsive solution before a finite burn solution could be obtained. 
This meant that in the finite burn solution the target conditions were 
those of the "desired" orbit which was constrained to intersect the 
approach hyperbola j therefore, it differed from the nominal design 
orbit. Had the finite burn calculation been targeted to the nominal 
design orbit, the resulting orbit would have been closer to nominal. 

In the calculation of the orbit insertion maneuver for Lunar Orbiter II, 
the initial Plight Operations solution resulted in a perilune altitude 
which was about 50 km off nominal, while argument of perilune was 
essentially nominal. Although this was a satisfactory solution in that 
all the parameters were within their allowable limits, it was highly 
desirable to get perilune altitude closer to nominal while allowing 
argument of perilune to vary from nominal. (Argument of perilune was 
of lower priority in the control criteria). The backup calculation 
obtained at the Seattle Operations Center provided a more satisfactory 
solution. 

By performing a finite burn search and allowing argument of perilune to 
be the free variable, a solution was obtained with perilune altitude near 
nominal and argument of perilune within its ' allowable limits . These 
results were then used by Plight Operations in their final calculation of 
the maneuver. 

Orbit Adjustment 

Orbit adjustment maneuvers were generally included in the mission design 
to lower perilune altitude to that required for photography. At this 
time adjustments were also made to correct certain orbit errors. Again 
control criteria_had been specified and the maneuver was calculated to 
get as many of the orbit parameters at their nominal value as possible 
while remaining within a AV budget. ’(Although this was usually the 
last planned maneuver for the photographic mission, a AV capability 
to crash the orbiter was retained. ) There were no significant problems 
on any of the missions in obtaining satisfactory solutions. 

7.3.2 PHOTOGRAPHIC MANEUVERS 

Attitude maneuvers were calculated to provide for photographic coverage 
of the designated areas. The problem consisted of two parts: l) the 

determination of time when the spacecraft would be at the correct 
position relative to the photo site (this information was derived from 
the orbit determination results), and 2) the determination of the 2- or 
3- axis maneuver which would orient the spacecraft for the required 
photographic frame coverage. A special flight operations software 
computer program was available to generate the attitude commands necess- 
ary. A complete discussion of these maneuver calculations is beyond 
the scope of this report. 

The overall accuracy of the photographic maneuver guidance is indicated 
in Figure 7.-3, where the error in the camera axis intercept is shown in 
terms of its down-track and cross-track components for several of the 
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Photographic 

Site 


Error in Camera Axis Intercept 
Degrees on Lunar Surface 

Down-Track Cross-Track 


LO 1-1 

-0.33 



-5 

-0.26 

— 

-8.1 

0 

— 

LO II-2 

+0.07 

— 

-5 

+0.17 

— 

-8 

-0.33 

— 

-12 

+0.66 

— 

LO III -2a 

+0.09 

+0.12 

-6 

-0.09 

+0.41 

-76 

+0.18 

+0.10 

LO V-19 

-0.13 

-0.08 

-31 

+0.13 

0 

-43.1 

-0.03 

-0.02 


FIGURE 7.-3 PHOTOGRAPHIC LOCATION ACCURACIES 
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photo sites from four of the five missions. This error is due to (l) 
error in knowledge of state (orbit determination error and attitude 
error), (2) error in forwarding the state (due primarily to the un- 
certainty in the lunar gravitational model), (3) error in calculating 
the maneuver, and ( 4 ) maneuver execution error. Only the down- track 
component is shown for Lunar Orbiters I and II since vertical photo- 
graphy was designated on these missions. For the other missions, both 
the down-track and cross-track increments are shown as errors because 
it was intended to aim the camera directly at the photo site on these 
missions. 

The accuracy indicated in Figure 7-3 should not be confused with the 
accuracy in knowledge of photo site location (selenographic location of 
a specific lunar feature). This subject is covered in Section 7.5* 

7.4 GUIDANCE COMMANDS 

When the maneuvers were calculated and approved by the Space Flight 
Operations Director, the guidance commands were transmitted to the space- 
craft to perform these maneuvers. The commands were first coded and 
transmitted up to the spacecraft, re-transmitted down from the space- 
craft, verified, and then the command-execute signal was' transmitted to 
the spacecraft. 

The discipline of the command system which was developed at the Space- 
flight Operations Facility was as essential a part of the Lunar Orbiter 
guidance and control system as the hardware. It was this rigid system 
of pre-mission planning, control of software, flight path analysis and 
command computational routines, subsystem performance monitoring and 
analysis, command generation and transmission routines for both real 
time and stored program commands, and tight overall management by the 
Space Flight Operations Director's staff that ensured minimum error. 

The system allowed flexible real time modification to mission plans 
and provided extensive review and cross checking. 

Planning and development for flight operations took about 2 years. The 
operational software ; i.e., the computer programs to be used for orbit 
determination, command generation, stored program formulation and trans- 
mission, star identification, telemetry data handling, etc., were checked 
out by formal testing and were not allowed to be changed after certi- 
fication except for very grave reasons. 

Specific procedures were worked out for preparation, approval, communi- 
cation, and verification of both real time and stored program commands 
to the spacecraft via the DSIF station. These procedures were verified 
during operations team training which occurred over the six months prior 
to the first flight. 

Prior to each mission the command programmer analysts assembled (from 
several sources): 

a) A simplified timeline sequence which included DSIF rise and set, sun 
rise and set, photo site times, and stored program transmission times. 
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b) A photography budget plan which included frame number assignments 
for photo sites, film processing time allocation, and photograph 
readout time allocations. 

c) A core map plan based on items (a) and (b) which showed what would 
be included in each stored program transmitted to the flight pro- 
grammers . 

During the mission a planned sequence of events was issued about once 
a day by mission control (SFOD's staff). This was a computer generated 
2 or 3 day schedule of activities which included ephemeris and photo- 
graphy events noted above, preliminary and final command conferences 
for reviewing proposed stored programs, special events such as RTC 
camera adjustments, attitude control updating, Canopus tracker cycling, 
command activity features such as the time FPAC must complete and submit 
for review their maneuver data, and the transmission time for each stored 
program. 

The Flight Path Analysis and Control (FPAC) group performed orbit de- 
termination calculations using tracking data, computed 2 axis attitude 
maneuvers, finite burn duration, and ignition time for velocity maneuvers, 
computed 3 axis attitude maneuver magnitude and camera actuation times, 
computed data such as cone and clock angles which were used by SPAC for 
generating antenna pointing commands. The Subsystem Performance Analysis 
and Command (SPAC) group provided attitude control mode switching re- 
quirements, update maneuver requirements, antenna pointing and communi- 
cation subsystem switching requirements, etc. These were reviewed at 
a preliminary command conference then used by the command programmer 
analyst to generate a specific core map. 

The Command Generation - Program (COGL) was used to convert this core map 
into a command assembly and store it in the SFOF for automatic trans- 
mission to the spacecraft. The command assembly, which was a listing of 
the command words for the core map' in spacecraft computer language, 
was printed out and used to check the telemetry readout of commands as 
they were transmitted. These commands were also punched on paper tape 
and read into an engineering test model of the spacecraft computer where 
they were independently checked. The engineering test model then ran at 
real time duplicating the spacecraft functions which helped to verify the 
spacecraft computer. COGL also printed out a time tagged sequence which 
resulted from simulating the stored program and any real time commands 
that were included. The program recognized and indicated in the printout 
errors such as invalid command combinations and errors in commands. 

The COGL printout was taken to the final command conference where it was 
reviewed by SFOD staff, representatives from SPAC, FPAC, and NASA mission 
advisors. Once approved, the commands were transmitted to the space- 
craft. 

The handling and checking of real time commands was also very formalized. 
Requirements for RTC's were usually generated by a subsystems analyst for 
housekeeping purposes such as antenna adjustments or attitude update 
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maneuvers. Frequently they were used to make last minute changes to 
stored program maneuver magnitudes. Each RTC was vnritten in space- 
craft computer language by a command programmer analyst.. It was checked 
by the SPAC director and approved for transmission by the SFOD. After 
approval it was read to the DSIF over voice link. After the command was 
set into the transmission equipment at the DSIF and before it was execut- 
ed, it was read back by voice for verification. After verification it 
was executed. 

The significant thing about this elaborate system was that no real time 
or stored program command was ever sent without extensive checking. 

Before an error could pass through, it would have to be independently 
approved several times. During the five Lunar Orbiter flights less 
than 10 incorrect commands were transmitted and executed. Examples of 
the kind of errors which did occur were: 

a) An incorrect maneuver magnitude was transmitted. 

b) A mistake was made in one extended mission program in which an RTC 
rather than an SPC code was placed on a stored program sequence. 

This resulted in the spacecraft trying to obey approximately 15 
maneuver commands. This eventually caused loss of power, tumbling, 
and temporary dropout of the programmer. Fortunately, "random 
recovery" occurred. 

c) A core map was transmitted which failed to interface properly with 
the current core map. The result was missing a maneuver and improper 
incrementing of a maneuver magnitude. A quick thinking command pro- 
grammer analyst was able to generate a sequence of RTG's which re- 
turned to' the proper program sequence. 

d) After a series of experiments during extended mission, the space- 
craft was erroneously left at an "off-sun" attitude with the space- 
craft drifting away rather than toward the sun. This caused loss 
of power and tumbling. Here again "random recovery" occurred but 
with a serious loss of nitrogen gas. 

e) An emergency RTC was set into the "command drawer" at the DSIF 
during a maneuver for execution immediately after the planned 
maneuver. The command was executed too early and interrupted the 
maneuver angle resulting in too small a maneuver angle. 

7.5 PHOTO SITE ACCURACY ANALYSIS 

A post flight data analysis has been conducted under Contract NAS 1-7954 
to determine the accuracy in the knowledge of the locations of the photo- 
graphs taken during the five missions. It was determined that the best 
accuracy in knowledge of site location was one km. The principal cause 
of these location errors was due to orbit determination errors, and the 
secondary cause was due to attitude control errors. 
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Orbit determination errors could have been reduced with a better model- 
ing of the universe. This applies particularly to the lunar gravi- 
tational potential model. A gravitational series expansion about the 
surface rather than about infinity might prove helpful. 

Attitude control errors could have been reduced with a tighter operation- 
al control of attitude. Long periods of operation on gyro references 
rather than on celestial references resulted in significant body axis 
drift. 

A calibration procedure which included a direct measurement of the 
geometry- of the camera's field of view while installed in the space- 
craft would have simplified the post flight data analysis. Although 
the camera optical axis was measured as installed on the spacecraft by 
a mirror attached to the center of the camera lens, this did not define 
the actual alignment or location of the photo frame mask. For example, 
the corner locations of the photo frames could be obtained only by 
analysis of the drawings and assembly dimensional tolerances. 

7.6 CONCLUSIONS AND RECOMMENDATIONS 

The conclusions from this study of the Lunar Orbiter guidance concept 
are: 

1) The Guidance concept employed on Lunar Orbiter was adequate for the 
task. 

2) The approach taken to establish tolerances on components was more 
expedient than wise in a number of cases and involved added cost to 
the program. 

3) All velocity control maneuvers were accomplished within the speci- 
fied control criteria. 

4 ) Operational software used in calculating orbit insertion maneuvers 
should have the capability to target to a wide range of orbit para- 
meters. Where there is a discernible difference between an impulsive 
and a finite burn maneuver, the finite burn calculation should be 
targeted to the nominal design conditions. 

5) A better definition of the lunar gravitational potential model would 
significantly reduce orbit determination errors and errors in for- 
warding the spacecraft state. 

6) Attitude control errors could have been reduced with a tighter 
operational control of attitude. 

7) Flight operation and command generation activities which involve many 
people make the result vulnerable to human error. A major problem is 
boredom during routine operations. A well disciplined and highly 
motivated crew are essential ingredients for success. They must work 
within a framework of checks and balances $ provided with communication 
pro ced vires and management with rigid control of changes to the basic 
computer programs. 
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Recommendations for "doing differently if one had it to do over" are: 

1) Guidance hardware requirements should be established prior to re- 
leasing procurement specifications by an error analysis to show the 
impact of gyro drift rate, maneuver integration accuracy, limit 
cycle deadband, and sensor alignment. 

2) Back-up procedures which are devised to meet emergency conditions 
should not be adopted as standard operating practice on subsequent 
spacecraft flights without assessing the effects. For example, 
long periods with attitude references to gyros instead of Sun and 
Canopus, introduced errors in photographic coverage and inaccuracy 
in photo site locations. 
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Figure 8-1: INERTIAL REFERENCE UNIT 
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8.0 COMPONENTS 

A component level review of the guidance and control system was made. In- 
cluded were the major hardware items as follows: 

1. Inertial reference unit 

2. Sun sensors 

3. Canopus star tracker 

4. Flight electronics control assembly-programmer , switching assembly, 
and closed loop electronics 

5. Thrust vector control actuator 

Since each of these components functioned as a part of one or more of the 
subsystems, the discussion which follows emphasizes the component aspects 
not covered previously. It is convenient to divide the discussion of the 
flight electronics control assembly into two sections: one covering the 

programmer functions including the switching assembly; and the other 
covering the closed loop electronics. 

8 . 1 INERTIAL REFERENCE. UNI T 

The inertial reference unit (IRU) was an integral part of the attitude con- 
trol, thrust vector control, and the velocity control subsystems described 
in Sections 3.0, 5-0, and 6.0, respectively. It was mounted on the space- 
craft equipment mounting deck and aligned to the spacecraft control axes. 

8.1.1 IRU DESCRIPTION 

The Inertial Reference Unit (IRU) for the Lunar Orbiter spacecraft was a 
package containing three strdpped-doun gyros for attitude measurement, an 
accelerometer for thrust cutoff, and their associated electronics (see 
Figure 8-1 ). The gyros were single-degree-of-freedom, floated, rate-inte- 
grating units which provided angular rate or position error signals in 
three primary orthogonal body axes. The accelerometer was a pulsed inte- 
grating pendulous unit which provided integrated acceleration information 
for the spacecraft along the roll axis. The IRU provided rate information 
for celestial reference acquisition, maneuver measurement, and celestial 
reference limit cycle. The IRU provided position error information during 
operation at maneuvered angles; e.g., a photo sequence, velocity maneuver, 
thermal relief or during celestial reference occultations . During velocity 
maneuvers the IRU also provided a signal proportional to the linear accelera- 
tion of the spacecraft to provide an accurate measure of velocity change 
during engine thrusting. Among the design criteria for the unit, reliability 
received top consideration. 

Parts and components were selected that had been proven in earlier space 
or missile applications. The SIG-1000 gyro, used on an Air Force satellite 
built by General Electric, and the pulsed integrating pendulum accelerometer 
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(16PIP ) are examples. The 16 PIP was rated for manned spaceflight by NASA 
for the Apollo program. The minority of parts for which no experience 
existed were individually qualified specifically for the IRU. Materials 
and processes, too, were individually screened for reliability in the de- 
sign. The next criterion was low weight and power. This led to the beryl- 
lium frame, extremely compact electronics packaging, and the design of a 
number of low-power circuits. 

8.1.2 DESIGN REQUIREMENTS 

The attitude, reaction, thrust vector, and velocity control subsystems set 
the requirements for the functional operating modes of the IRU. These are 
summarized as follows: 

1) Rate Mode - provide an electrical signal proportional to the spacecraft 
angular rate about the three orthogonal spacecraft axes. 

2) Rate Integrate Mode - provide an electrical signal proportional to the 
spacecraft angular displacement about the three orthogonal spacecraft 
axes. 

3) Velocity Mode - provide an electrical signal proportional to the linear 
acceleration of the spacecraft along the spacecraft roll axis. 

The specific IRU performance requirements for these modes of operation are 
listed in Figure 8-2. 

8.1.3 DEVELOPMENT AND OPERATION 

Floated rate integrating gyroscope and integrating accelerometers capable 
of meeting the performance requirements for Lunar Orbiter were within the 
state-of-the-art at the time of the proposal. However, there was no "on- 
the-shelf" package which contained the three gyros, accelerometer, and 
electronics within the desired weight and power limitations. Initially the 
weight objective was 9.1 lbsj the power was 22 watts. Both were approxi- 
mately half of what was available from existing equipment. (The actual 
weight turned out to be 13.4 lbs and the upper limit on power was 30 watts 
with heaters on. ) 

It was necessary to request proposals from inertial instrument vendors for 
an IRU tailored to these requirements. There were five vendor replies to 
the Inertial Reference Unit request for proposal. Those responding were 
Kearfott, Minneapolis-Honeywell , Nortronics, Reeves, and Sperry. Each in- 
put was evaluated on the basis of performance characteristics, predicted 
reliability, electrical power, mechanical characteristics, quality assurance, 
and cost. Both the Sperry and Kearfott proposals were judged to satisfactorily 
meet the requested design objectives. The Sperry Gyroscope Company of Great 
Neck, New York, was selected to build the IRU even though there was no Boeing 
experience with the SYG-1000 gyro. Their proposed cost was lower which was 
decisive in the selection. Conservative, proven design techniques were pro- 
posed to be used. The difficulties later encountered with manufacturing 
yield in the instruments were not anticipated. Boeing's research, develop- 
ment, laboratory, and test work on attitude control systems prior to the 
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RATE MODE 

RATE INTEGRATE MODE 

VELOCITY MODE- 

Nominal Scale Factor 

4 Volt/Deg/Sec 

4 Volt/Deg 

0.1 Ft/Sec per pulse 

Linear Range 


+ 3 Deg/Sec 

+ 3 Deg 

+ 20 ft/Sec 2 ( < .6"g" 

Saturation 


3 Deg/Sec 

Also withstand + 5°/Sec 

+ 4 Deg 

,6"g" 



for 30 minutes 



Error 


,8°/Hf @ 0 Deg/Sec 

.01° @ 0° 

Total acce lerometer 



2.0°/lir @ .5 Deg/Sec 

.01° @ .25° 

Bias not to exceed 
3 x 10 -4 g in range of 



108°/Hr @3.0 Deg/Sec 

.18° @ 3.0° 

.087 g to .23 g 

Threshold 


. 2°/Hr 

.01° 


Resolution 


1.0°/llr @ .5°/Sec 

.01° @ + .5° 

+ l pulse 

Drift Rate 


G sensitive < 2,0°/Ur/G 

G insensitive < ,5°/hr @ °° 

— 



nor change >.5°/hr/g 
between measurements 

<.7°/hr @ + 2.0° 


Dynamic Response 


300 radians/sec if under 

Time constant .0017 sec 

200 pulse/sec- 


damped 





110 radians/sec if over 

Nominal gain of 1 

N.A. 



damped 



Electrical Noise 


123 MV RMS 

1 MV RMS for f = .1 to 1000 R/Sec 




10 MV RMS for f > 1000 R/sec 


Power 30 watts 

at 21 VDC & 36°F mounting flange 

temp, (includes gyro heater & 

16 PIP power) 

Weight 14 lbs 

maximum, 9.1 lb goal (actual was 13 

i.4 lbs) 


Alignment -.01°$ 

orthogonal <.01° gyros & accelerometer input axes within .14° 



Hi-Rel solid state electronics to be used. 

3 SYG 1000 gyros, one 16 PIP accelerometer. Back-up IRU»s used C70-2564 Kearfott Alpha gyros. 


FIGURE 8-2 INERTIAL REFERENCE UNIT REQUIREMENTS 
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time of the Lunar Orbiter proposal provided a strong engineering preference 
for the Kearfott Alpha gyro. The JPL Mariner experience with the Kearfott 
gyros had been satisfactory. The confidence gained from these experiences 
was put to good use later in the program. 

8. 1.3.1 MAJOR DESIGN EVENTS 

A preliminary design review was held in September, 1964. Significant findings 
of the PDR meetings included the following items committed for further action: 
(l) IRU parts list and qualification status, (2) thermal tolerance study, (3) 
IRU mounting interface thermal and alignment considerations, (4) reliability 
analysis at the module level, (5) interpretation of soldering requirements, 

(6) primary power source impedance, (7) accelerometer and gyro traceability 
requirements, and (8) review of test plans. 

A critical design review was held in December of 1964. During these meetings 
it was brought out that design changes had been made to the SYG 1000 gyro and 
to the 16 PIP accelerometer. The changes were as follows: 

SYG 1000 Gyro 

Internal Changes 


o Fluid changed due to change in operating temperature 

o Fluid change resulted in a change in the internal balance 
weights which increased the g sensitive adjustment resolution 
to + l°/hour. 

o Change in limit stops added a pin 
External Changes 

o Larger flange diameter 
o Changed heater winding 
o Changed nameplate 
16 PIP Accelerometer 

c Enlarged volume compensator . 

o Secondary seal > All internal changes 

o One temperature probe removal ' 

As a result of these changes, Sperry was directed to supply a list of all 
drawings, engineering bulletins, and test specifications, designating latest 
revision letters and differences between the past and the Lunar Orbi.ter ver- 
sion of gyro and accelerometer. Also, because of the gyro fluid change, a 
description of the controls for the acceptable contamination level of the 
gyro fluid was required. 
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The other major item evolving from the Critical Design Review required Sperry 
to submit a deviation request for non-compliance of the gyro, accelerometer 
and IRU electronics to the 200-Y specification on soldering techniques. 

Assembly and test of the first Inertial Reference Unit built to the flight 
hardware drawings began at Sperry early in 1965. The first serious out-of- 
specification condition occurred on the engineering prototype unit while it 
was undergoing Flight Acceptance Test (FAT) at Sperry. The unit showed 
large changes in its "Rate Integrate Mode" scale factor. A series of inves- 
tigative tests were performed on the breadboard IRU at Boeing in order to 
determine an explanation for the changes. The breadboard gyro ’"RIM" scale 
factor was found to be sensitive to thermal environment even though the 
gyro temperature control circuit was functioning as designed. This sensi- 
tivity was attributed to changes in the internal gyro temperature distribu- 
tion, in response to environmental changes, which caused gimbal gain changes. 
It was predicted that a significant change in RIM scale factor would occur 
during the thermal- vacuum portions of IRU FAT. 

By August 1965, a pattern had been established which indicated that a signi- 
ficant problem existed in the performance of the gyros used in the Inertial 
Reference Unit. At that time, the IRU's had failed to meet performance re- 
quirements in g-insensitive drift rate, g-sensitive drift rate, noise, rate 
mode scale factor, and rate integrate mode scale factor. The gyros had 
exhibited bad pivots, excessive noise, high mass unbalance, high g-insensi- 
tive drift rates, heater loop oscillations, and excessive contamination of 
damping fluid. Null shifts and gain changes were also occurring within the 
16 PIP accelerometer and its associated electronics. 

A series of Boeing-Sperry meetings were held to resolve the performance 
problems. While action was being taken to solve the problems of the "main- 
stream" IRU program, Boeing also began to consider a "backup" IRU program 
in which Sperry SYG 1000 gyros would be replaced by Kearfott Alpha 2564 
gyros. Technical justification for considering this action was as follows: 

1. The Sperry SYG-1000 and Kearfott Alpha 2564 gyro both derived their 
salient design characteristics from a G.E. specification relating to 
an Air Force spacecraft program, for which Sperry had delivered 

155 units, and Kearfott, at the time of backup IRU gyro selection, 
had delivered 105 units. The Kearfott gyro therefore was similar to 
the SYG 1000, and could be incorporated in the L.0. IRU with only a 
change in thermal insulating washer and a change in envelope emissivity. 

2. The Kearfott Alpha 2564 had an outstanding record of 95 percent yield 
on the above-mentioned G.E. program. 

3. -The Kearfott Alpha 2564 gyro had 2.2 times the angular momentum com- 
pared to competitive instruments in its weight, power and size class, 
and was therefore fundamentally less sensitive to production imperfec- 
tions affecting major performance parameters (drift, stability). 

4 . Use of the Alpha 2564 gyro would result in a total power saving pre- 
dicted to be 4 l/2 watts in the backup IRU, due to a smaller spin 
motor power consumption and higher floatation temperature. The 
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thermal design required that the equipment mount deck serve as the 
heat sink for the IRU. Hie deck temperature varied from 35 F to 
85°F (nominal design) primarily depending on outside radiation. The 
gyro thermal control concept was for the heater to be off at the top 
deck temperature, 8$°F, and full on at 35 F. The key item in the 
thermal resistance path, which was different for the Sperry gyro 
(l45°F) and the Kearfott gyro (165 F), was the insulating washer 
through which the spin motor power was dissipated with the deck at 
85°F. Since the Kearfott gyro spin power was less and the delta 
temperature from gyro to deck was greater, the thermal resistance 
was also greater for the Kearfott gyro. Hence, the heater power 
required at 35°F was also less for the higher floatation temperature. 

In December 1965, Boeing recommended a backup IRU with substitute gyroscopes 
for the first flight spacecraft. The budgetary commitment was limited 
pending verification of compatibility of substitute gyros and/or continued 
loss of confidence in the SYG 1000 gyros. In March 1966, NASA directed 
Boeing to go ahead with the backup program. This program was implemented 
by diverting three (3) Inertial Reference Units from the mainstream SYG 
1000 gyro program to the backup program. These units were to be modified 
by Sperry to incorporate the Kearfott gyro and replace the 16 PIP accelero- 
meter with the accelerometer designed by Sperry for the Polaris program. 

During this same period of time (January 1966 - June 1966) solutions were 
being found to many of the mainstream IRU problems. Test procedures were 
being revised and test procedure tolerances widened as a result of specifi- 
cation requirements being relaxed. 

A summary of problems and solutions associated with the SYG 1000 gyro is 
given in Figure 8-3, the 16 PIP accelerometer in Figure 8-4, and the IRU 
Electronics in Figure _8-5. 

As the backup IRU program reached production, units were found to suffer 
from the same heater loop instability at critical operating conditions as 
had occurred in the mainstream IRU* s. Excessive gain in the temperature 
control loop was the cause of that trouble. However, the backup IRU's 
showed larger and unacceptable electrical noise on the output of the rate 
mode because of coupling of the heater oscillations through the power 
supply and into the pick-off excitation which was at J+.B KHz. To elimi- 
nate these oscillations the heater modulation frequency was changed from 
2.4 KHz to 9-6 KHz. 

Failure of a "Polaris" accelerometer in a backup IRU and one in component 
test resulted in a recommendation from Sperry that this accelerometer model 
not be cooled below 75°F when inoperative. This limitation disqualified 
the "Polaris" type PIP from the Lunar Orbiter program due to a conflicting 
temperature constraint of the camera system which governed spacecraft tem- 
perature during handling operations prior to launch. The backup IRU pro- 
gram therefore reverted to using a 16 PIP accelerometer. 
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PROBLEM 


CAUSE 


o Mass Unbalance 
(Ground Test Only) 


o Girabal Hangup 
(Ground and Space) 


o Temperature Control 
(Ground and Space) 

V 

o 

<2 


o- Fixed Torque Drift 
(Ground and Space) 


o Life, ground and 
space 


o Total Yield 


Change of fluid for 
145°F float. Fluid 
absorption into float 
displacing air. 


Balance weight adjust- 
ment only in + 1° per 
hour increments. 

Fluid contamination 
Damaged Pivots 

Heat sink varied from 
+35 °F to +85 °F nominal 
Convection caused addi- 
tional cooling at ambient 
test conditions 

Heater control loop gain 
caused instability 

Unknown 


Bearing wear 


FIGURE 8-3 SYG- 


EFFECTS 


SOLUTION 


Results of ground New mounting insulator on gyro, 

tests changed from Impregnate dynasyn to hasten 
one test to the next. fluid wetting of float. Recali- 
brate frequently to check on 
result of technique. 

Original spec value Increase tolerances based on 
of + l°/hr could realistic requirements, 

not be met. 

Loss of inertial Revise filling procedure 

hold reference Revise balancing procedure 

Revise quality control 

Heater power required Increased allowable power 
to maintain temp. 

Power used was a Tolerances increased to allow 

function of the test for effect. 

conditions 

Electrical noise in Lowered gain, added filters, 
gyro output 

Ramps in output Screen the gyros and eliminate 

Inertial hold or offenders. Increased tolerances, 

maneuver errors. 

Ground test time Lower operating temperature 

Reliability low for Float life demonstration 
extended life test initiated. Frequent run- 

down test . Gyro and IRU burn- 
in. Limit maximum hours at 
launch to 2000 hrs. 

Launch delay Implement backup IRU 


GYRO PROBLEMS 
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PROBLEM 

CAUSE 

EFFECTS • 

SOLUTION 

o Null Shifts & 

Improper Warmup 

AV Accuracy 

Close loop after warmup prevented 

Gain Changes 

Improper Orientation Same 

(Pendulum should 
hang down) 

excessive fluid forces on pendulum 
suspension. Store and warmup with 
output axis horizontal. This pre- 
vented pendulum from resting on 
stop which caused bias shifts to 
occur in the null. 

0 Slow Response 
(several 
minutes) 

Bellows leak 
(bubble) 

Same 

Redesign bellows to lower stress. 
Bellows life test - low confidence 
in realism and results. 

Total Yield 

— 

Launch 

delay 

Increase tolerances 


FIGURE 8-4 


16 PIP ACCELEROMETER 
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PROBLEM 

CAUSE 

EFFECTS 

SOLUTION 

Rate Mode Spikes 

EMI 

Maneuver accuracy 

Filters 

Extra A V Pulses 

Same 

AV error 

Same 

Temperature Hunting 

Loop Gain 

Gyro Noise 

Lower gain; change PWM 
f re quency 


FIGURE 8-5 


IRU ELECTRONICS 


D2-1 14277-2 


D2-1 14277-2 



i 


Figure 8-6: ATTITUDE CONTROL SUBSYSTEM 

Airbearing Simulator 
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8. 1.3. 2 TESTING 

An extensive test program was initiated that encompassed all levels of test. 
The formal portion of the test program included: (l) Slight Acceptance 

Tests, (2) a Qualification Test, ( 3 ) a Reliability Demonstration Test, and 
(4) an Incoming Acceptance Test. In addition to this formal test program 
there were gyro life tests, breadboard tests, air bearing simulator tests, 
and special post-mission tests. These tests and some of the significant 
results are presented in the following paragraphs. 

A single axis breadboard IRU was made available to Boeing for test in late 
August 1964. It was evaluated in component and subsystem level engineering 
tests. Because of the question of life, a gyro life test program and a 
float life demonstration test was started by Sperry prior to the CDR in 
December 19 64. The float life demonstration tests continued throughout 
the Lunar Orbiter program. During this same time period, Sperry built a 
three axis IRU breadboard for use as an engineering evaluation tool and 
for 3 axis development tests. Sperry conducted tests on the 3 axis IRU 
breadboard during the period 31 October through 19 November 1964. Test 
results and procedures were presented at the GDR in an effort to demon- 
strate that the IRU design would meet the specification requirements for 
rate mode and rate integrate mode. A 200 hour Boeing test program on the 
single channel IRU breadboard indicated that the unit would not meet all 
of the performance requirements. Later tests of the 3 axis breadboard at 
Boeing showed that the unit performed within specifications and large im- 
provements in the electronics over the single axis breadboard were noted. 

IRU output noise and gyro heater oscillations appeared to remain as problem 
areas. 

The 3 axis breadboard IRU was next used on a 3 axis air bearing platform 
simulation in conjunction with development testing of the Lunar Orbiter 
attitude control subsystem. The air bearing platform simulator (shown in 
Figure 8-6) contained all of the ACS hardware, including sea level thrusters, 
was mounted on a "friction-free" platform which simulated the vehicle 
inertias in pitch, yaw, and roll. These tests are discussed in more detail 
in Section 3*0. 

The average time required by Sperry to perform a flight acceptance test on 
an IRU was originally 474 hours. After Boeing and Sperry teams "revised 
these procedures, this figure was reduced 30 percent to an average time of 
329 hours per unit. Many of the tests, such as the RIM Bias Drift Test, 
simulated the actual use of the IRU, while others, such as the tumble tests 
and low speed rundown time tests, were not strictly performance tests but 
provided confidence in the life and quality of the IRU. 

A summary of problems occurring during component vibration qualification 
testing and actions taken to obtain an acceptable design are discussed in 
the following. When the inertial reference unit was subjected to the quali- 
fication vibration levels initially called out in the Environmental Criteria 
Document for all spacecraft equipment, high internal resonances were ob- 
served. Parts most affected were gyros, accelerometer, and electronic cards. 
Electronic parts also broke. Redesign included stiffening the circuit cards, 
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cementing parts in place, and providing flexible leads where necessary. The 
beryllium frame could not be materially altered in the required time schedule 
to improve the accelerometer and gyro environment. Retesting repeatedly in- 
dicated that the IRU .design would have great difficulty in passing the re- 
quired 15 g sine vibration levels. Because of the evidence that these arbi- 
trary vibration levels -would not exist in the spacecraft environment, special 
tests were conducted of a dynamic model of a spacecraft with an instrumented 
IRU mounted on the equipment mounting deck. Although the vibration level 
input to the spacecraft was at the level required by the spacecraft vibration 
specification, there was considerable attenuation at the location of the 
IRU. This was especially true at the higher frequencies. On this basis the 
vibration envelope required for the IRU was adjusted to what the IRU could 
safely pass with the partial fixes incorporated. 

These tests demonstrated that the actual magnification factors on vibration 
environment for the IRU as mounted on the spacecraft equipment mounting 
deck were less than originally estimated and specified. Therefore, the 
final vibration levels used for sine wave and random vibration tests were 
reduced as shown in Figures 8-7 and 8-8, respectively. In addition, it 
should be noted that flight data recorded even lower levels of acceleration. 

Qualification Tests were conducted to determine that the design and fabrica- 
tion procedures on IRU's were adequate to allow for expected variation in 
individual articles and environments, and that these variations did not com- 
promise the required performance. Further objectives were to locate possible 
failure modes, and determine the effects of varied stress levels and combi- 
nations of tolerances on equipment performance. 

Reliability Demonstration Tests were conducted in order to demonstrate two- 
mission capability by subjecting the system to the vibration and thermal 
environmental conditions and excitation voltage fluctuations expected during 
a launch and mission in - two cycles with performance tests between cycles. 

The period of each of the two mission simulations was in excess of 30 days, 
the expected time for the primary mission. 

Boeing conducted Incoming Acceptance Tests (IAT) on all mainstream "flight 
quality" IRU's prior to installation on a spacecraft. Flight Acceptance 
Tests, Qualification Tests and Reliability Demonstration Tests were con- 
ducted by Boeing on all "backup" IRU's according to the same requirements 
and procedures used by Sperry for the mainstream IRU' s except that the RDT 
time periods were reduced to result in two 15 day simulated missions. 

Figure 8-9 shows the failure rate (failure density, 0 , in failures per 
hour) as a function of test hours to failure on the IRU. The failures con- 
sidered include those attributable to design deficiencies, part failures 
and manufacturing errors and deficiencies. Examination of the curve suggests 
that approximately 600 hours of test time (or burn-in) was required to ensure 
that the infant mortality rate portion of the curve had been passed. 

8. 1.3. 3 MISSION PERFORMANCE 

The primary photo mission of the Lunar Orbiter spacecraft required a 30-day 
life which was reflected in the IRU specifications. In addition an extended 
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SINE FREQUENCY, ept 


FIGURE 8.-7 1RU SINE VIBRATION ROLL (X) AXIS 
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FIGURE 8.-8 IRU RANDOM VIBRATION 
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START/ 




OPERATING 

STOP 




HOURS 

CYCLES 

GYRO MODEL 

LO I 

(SN 106 Mainstream) 
(Crashed 10-29-66) 



Sperry SYG 1000 


o Ground test 

864 

349 



o Space Flight 

1914 




o Total 

2778 

349 


LO II 

fSN 109 Mainstream) 
(Crashed 10-11-67) 



Sperry SYG 1000 


o Ground Test 

1574 

183 



o Space Flight 

8120 




o Total 

9694 

183 


LO III 

(SN 113 Backup) 
(Crashed 10-9-67) 



Kearfott Alpha II 


o Ground Test 

392 

114 



o Space Flight 

5913 




o Total 

6305 

114 


LO IV 

(SN 111 Backup) 

(Last Communication 7-17-67) 



Kearfott Alpha II 


o Ground Test 

1087 

212 



o Space Flight 

1703 




o Total 

2790 

212 


LO V 

(SN 110 Mainstream) 
(Crashed 1-31-68) 



Sperry SYG 1000 


o Ground Test 

1700 

375 



o Space Flight 

4377 




o Total 

6077 

375 



Total Space Hours 

Average Power used during thermal 


vacuum test 


IRU - 22,027 



GYRO - 66,081 

22 watts @ 85°F 

Sperry SYG 1000 


27 watts @ 35 °F 

Gyros 

Failures 




19 watts @ 85°F 

Kearfott 2564 

Catastrophic - 0 

24 watts @ 35 °F 

Gyros 


Degradation - 1 

(Gimbal hysteresis during spacecraft 
limit cycles with rates in the range 
of ,001 deg/sec.) 


FIGURE 8-10 IRU OPERATIONAL LIFE 
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mission life was realized which substantially exceeded the minimum require- 
ment. Space flight operating time ranged from a minimum of 1914 hours on 
L.O. I to a maximum of 8120 hours on L.O. II. A summary of IRU operational 
life, given in Figure 8-10 shows the individual IRU operating hours, total 
gyro space hours and type of gyro {Sperry or Kearfott) in each IRU. Be- 
cause of the manufacturing and schedule problems with the Sperry SIG 1000 
gyro, the Kearfott Alpha was used as a backup and flown on two of the five, 
missions. There were no catastrophic mission failures and only one indica- 
tion of performance degradation which was with a Sperry gyro. During the 
mission of L.O. II the roll reference attitude was lost by a slow drift 
while in the rate integrate mode. It was believed that this failure was 
due to an intermittent gimbal hangup. This gyro had been recommended for 
replacement following erratic behavior in Boeing tumble tests, but, because 
of schedule problems, it was flown. Mission success "proved" this to have 
been a good gamble. 

There were two other flight anomalies which recurred on IRU 1 s during flight 
but had no discernible effect on performance. 

Telemetry data from L.O. II, IV, and V indicated intermittent heater loop 
oscillations similar to those observed during ground tests. Usually these 
were associated with transient heating conditions, such as following an 
eclipse. The other anomaly observed on L.O. IV was a yaw gyro wheel cur- 
rent oscillation and an indicated temperature oscillation. There was no 

evidence that this affected the performance. 

* 

Lunar Orbiter gyro drift rate history is shown in Figure 8-11. The gyro 
drift rate data tabulated are the Rate Integrating Mode ’(RIM) or attitude 
mode g-insensitive drift rate measurements on the ground (last bench value) 
and in space (space flight average value). The elapsed time between the 
last bench value column and the space flight average value column is about 
two to four months, and the actual operating time about 100 to 300 hours. 

The degree of correlation between the ground and space data is excellent. 

The one exception was the yaw gyro for L.O. I. The fixed torque drift con- 
tinued to increase gradually with time from the value of .34 /hour shown to 
1.2 /hour by the end of Mission I. Fourteen out of fifteen gyros showed a 
drift rate stability ranging from 0.01 to 0.16 /hour. 

The total solar eclipse of October 1967 was predicted to have a severe ef- 
fect on spacecraft subsystems which were sensitive to low voltage of the 
electrical power system or low temperature. The gyro's of the IRU were of 
special concern. Special laboratory tests were made on a Lunar Orbiter 
inertial reference unit in October 1967. The tests revealed that’ warmup 
times after heater turn on and switching transients are problem areas when 
re-activating TRU' s that have been turned off. The tests were conducted 
to simulate environmental conditions predicted for Lunar Orbiter Spacecraft 
numbers II, III, and V which were all in orbit prior to the solar eclipse. 
The effects of turning the IRU off during the eclipse and then turning it 
on again after the eclipse were determined. The test results were long 
gyro motor spin up time to synch, a shift in drift rate, and switching tran- 
sients. These transients can cause undesired spacecraft attitude changes 
by commanding the reaction jets on. A decision was made not to turn Iner- 
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G INSENSITIVE DRIFT, RATE INTEGRATE MODE 


LAST 

SPACE 

MAX DEVIATION 

BENCH VALUE* 

FLIGHT AVE** 

FROM AVERAGE 

deg/hr 

deg/hr 

deg/hr 


ROLL 

LO I 

IRU 106 

-0.39 

-0.50 

0.36 


LO II 

IRU 109 

-0.03 

+0.19 

0.12 


LO III 

IRU 113 

+0.075 

+0.11 

0.03 


LO IV 

IRU 111 

+.048 

+.064 

0.03 . 


LO V 

IRU 110 

-.083 

+.045 

0.75 

PITCH 

LO I 

IRU 106 

-0.16 

-0.20 

0.20 


LO II 

IRU 109 

-0.09 

-0.13 

0.48 


LO III 

IRU 113 

-0.134 

-0.16 

0.09 


LO IV 

IRU 111 

+ .145 

+0.15 

0.07 


LO V 

IRU 110 

-.093 

-.078 

0.34 

YAW 

LO I 

IRU 106 

-0.34 

-1.20 

0.50 


LO II 

IRU. 109 

-0.47 

-0.32 

0.36 


LO III 

IRU 113 

+0.075 

0 

0.09 


LO IV 

IRU 111 

-0.018 

-0.08 

0.03 


LO V 

IRU 110 

-0.038 

-0.071 

0.05 


^Measured at null, R.I.M. drift test 

** Average value observed in + .2 degree deadzone 


FIGURE 8-11 GYRO DRIFT HISTORY 
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tial Reference Units OFF or On during critical periods of operation. Also 
to avoid the possibility of losing control of spacecraft II or III it was 
decided to crash these spacecrafts before the eclipse. However, the IRU 
on Spacecraft III was turned off after the last propulsive maneuver (designed 
to crash the spacecraft on the moon) and then turned on again. The "off" 
transient caused a spacecraft angular rate of approximately 110 degrees/hour, 
which corresponds quite well with expected spacecraft response to the IRU 
transient data obtained' during the October ground tests. Unfortunately, the 
telemetry link, was occulted after turn on and before the "on"' transient data 
could be obtained. The results of these laboratory and space flight tests 
indicate that the switching transients of IRU's (gyros) are quite complex 
and difficult to predict without experimental data. Spacecraft V survived 
the October eclipse without as much difficulty as expected and continued to 
function satisfactorily even though the equipment mounting deck temperature 
fell to 10 degrees F. 

8.1.4 CONCLUSIONS AND RECOMMENDATIONS 

The major conclusions drawn from this study of the Lunar Orbiter IRU are: 

1) The IRU performed adequately for this application. There were 22,027 
hours of space operation without a failure. The design would be 
applicable to other spacecraft now in design. 

2) No life or wear out limitations were evidence for missions up to one 
year in length once the IRU's were committed to launch. Minor degra- 
dation in performance occurred on one roll gyro which exhibited gimbal 
sticking. 

3) Ball bearing gyros of the quality class represented by the Sperry SYG 
1000 or the Kearfott Alpha have demonstrated an MTBF of 14,650 hours 
with a confidence factor of 95% • 

4) The non-g sensitive drift rate stability of 0.27°/hour (3 a ) on the 
ground for 16 months was achieved without calibration. A 30 day sta- 
bility of 0.1°/hour (3 a) was achieved. The laboratory measurement 
of g insensitive drift was duplicated quite closely in flight. 

5) Consistent IRU performance (for both gyros and accelerometers) was 
achieved as a result of meticulous attention to a multitude of details 
which included: 

a) Cleanliness controls 

b) Parts and process control 

c ) Skilled workmanship 

d) Careful and exact testing 

e) Test equipment control 

f ) Experienced personnel 


% 


119 



D2-114277-2 


6) A comprehensive and thorough IRU test plan is mandatory for a success- 
ful program. This is the means by which a design reaches operational 
maturity. Performance tests which simulate the actual use of the IRU 
provide the only rational basis for comparison of performance on the 
ground and in space) e.g. , measurement of drift rate in open loop 
(rate integrate} mode on the ground. Other types of tests, which may 
not be strictly performance tests, are needed to provide confidence 
in the quality of the IRUj e.g., tumble tests at the systems level. 

7) A burn-in or minimum operating life of about 600 hours prior to launch 
was required to eliminate infant mortality failures in the IRU. An 
elapsed time meter should accompany each unit so as to have a direct 
measure of the operating hours. 

The recommendations for "what one should do differently if one had it to 

do over" are: 

1) An earlier examination of the real mission requirements for accuracy 
and environment could have saved both time and money. Requirements 
were relaxed only after it became evident that the IRU design was 
incapable of passing. 

2) Gyro and accelerometer instruments for an IRU should be selected from 
an in-being production line producing units of the quality class re- 
quired. Much of the problem associated with the SYG 1000 gyros and 
the 16 PIP accelerometers could be attributed to restarting at near 
zero on the manufacturing and test experience curve after a shutdown 
of production. 

3) Any change from a previously approved article in an IRU instrument or 
a manufacturing process should be treated with extreme caution. Even 
damping fluid change -can cause major yield problems. 

4) Fixed drifts could be corrected in flight by providing a rate integrate 
mode trim capability. 
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8.2 SDN SENSORS 

The sun sensors were one portion of the attitude control subsystem described 
in Section 3.0. The function of the sun sensors was to provide a reference 
attitude for the pitch and yaw axes. 

8.2.1 SUM SENSOR DESCRIPTION 

ft 

The sun sensors used on Lunar Orbiter were procured’ from the Ball Brothers 
Research Company and were derivatives of those previously used on the Orbi- 
ting Solar Observatory satellite (0S0). There were a total of five assem- 
blies on each spacecraft, as illustrated in Figure 8-12, a main sun sensor 
located on the equipment mounting deck, and four remote sensors located at 
the four corners of the heat shield. The main sun sensor, shown in Figure 
8-13, consisted of two groups of eyes, one for control of the pitch axis and 
the second for yaw axis control. Each group in turn was composed of a set 
of fine and coarse eyes, the field of view of the coarse being about 5 times 
as wide as the fine. The remotes were each a single eye, with two associated 
with each axis to provide a 4 7r steradian field of view. The sensing ele- 
ment was a silicon solar cell which may be compared to a current generator. 

The output current is proportional to the area of illumination and the angle 
of incidence of the sunlight. A properly 'chosen trim resistor produced 
a voltage across the resistor proportional to the exposure area and angle of 
incidence. The fine sensor utilized a changing illumination area to provide . 
the linear high gain signal. The coarse eyes operated strictly as a cosine 
function of the angle of incidence and, therefore, had a lower gain. 

The weight and dimensions of the components are tabulated below: 

Main sun sensor assembly = .6 lb Dimensions 1" x 4«4" Dia 

Remote sun sensor each .03 lb Approx l/2" x l/2" Dia 

(C3 coarse eye) 

The sun sensors were procured with long pig-tail leads attached, which per- 
mitted direct connection to interfacing units when installed on the space- 
craft. This eliminated the need for connectors for each sensor. 

8.2.2 DESIGN REQUIREMENTS 

Requirements on the individual sensor were derived from the arrangement on 
the spacecraft and from the specific performance for pointing accuracy. 

The 4 w steradian field of view was required to ensure sun acquisition 
from any initial attitude after separation of the spacecraft from the Agena. 
The fine sun sensor was required to be unaffected by secondary light sources 
(such as the bright limb of the moon) outside 20° of the null. There was 
considerable overlap provided by the array of sensors; e.g,, coarse sensors 
of pitch axis and yaw axis are both illuminated for large angles off sun. 

Even with solar panels or high gain antenna dish arranged to shadow one set 
of eyes, the other set provided sufficient error signal to cause sun acqui- 
sition. The detail requirements are listed as follows: 
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REMOTE COARSE 
SUN SENSORS +90°- 


REMOTE COARSE 
SUN .SENSORS JUST 
UNDER HEAT SHIELD 

(4 PUCES) 






COARSE & FINE SUN 
SENSOR 'JUST OFF 
CENTER TOWARD 
OMNI ANTENNA 


-COARSE SENSOR +80° 
(EXCEPT AS CUT OFF 
.BY HINGES) 


FIGURE 8-12 SUN SENSOR ARRANGEMENT 
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Figure 8-13: MAIN SUN SENSOR 
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MAIN SUN SENSOR 

Field of View: 

Fine eyes + 15° Linear for + 5° 

Coarse eyes + 80° Linear for + 15° 

Null Error: Fine sensor + 0.017° pitch or yaw 

Signal Output: 

Fine eyes: within ± 0.25° of null = 12 mv/degree 

+ 0.6 mv/degree 

within .25° to 2.5° = 12 mv/degree + .9 mv 
Coarse eyes: between + 12° = 2 mv/degree + 4 mv 

between + 10° + 60° > 20 mv 


REMOTE SENSORS 

Field of View: 2 Coarse eyes on spacecraft per axis + 90° 

A reference mirror was provided on the main sun sensor to provide alignment 
to the spacecraft. Alignment error of reference mirror to mounting surface 
was 18 arc seconds. 

8.2.3 DEVELOPMENT & OPERATION 

Two candidate approaches to the basic sun sensitive cell were available at 
the time of the Lunar Orbiter design. The Mariner & Ranger spacecraft had 
flown with cadmium sulphide photo resistive elements for sun sensors. In 
this method a sun shield casts a shadow, covering a portion of each cell. 

As the incident illumination changes angle, the area of each cell illuminated 
changes along with resistance. • The cells were connected in a bridge circuit 
such that a voltage proportional to the attitude error was obtained. 

The other method available was the silicon solar cell as used on 0S0. The 
decision to use the silicon cell approach was based on the following: 

1. Laboratory experience and familiarity - a silicon cell sensor had been 
used successfully on a Boeing air bearing attitude control simulator 
for over two years. 

2. Signal level and power requirements - the silicon cell sensor had an 
output of about 10 millivolts per degree and therefore required ampli- 
fication of 100:1 or 1000:1, depending on the deadzone desired. An 
amplifier with low noise and high gain was available from Ling Temco 
Vought requiring about 0.2 watts power. This was preferable to the 
cadmium sulphide cell which was used in a bridge circuit and required 
about 1 watt to produce the signal level of 10 volts/deg required for 
0.2° deadzone. 
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3. Dynamic Response 

Silicon Cell .001 second 

Cadmium Sulphide .1 second 

In general, fast response was desired to preclude Reaction Control Jet 
"on" delay or "off" delay from causing a weight penalty. In the L.O. 
application it was not a significant factor since the sun sensor was 
used only as a position reference. 

4. Availability - silicon cell sun sensors were available from Ball Bro- 
thers Research Company and the Bendix Corporation on a part number 
basis. Cadmium sulphide cells could be obtained from Nortronics Divi- 
sion of Norair (from Ranger experience) only on special order basis. 
There was no existing manufacturing source for "off-the-shelf" cadmium 
sulphide cells. 

5. Reliability - solid state devices were to be used throughout both de- 
signs. From a part count basis the silicon cell approach was less 
reliable because of the added amplifier. However, an open or short 
circuit, or cell failure would have been passive and possibly allow a 
degraded mode of operation. The cadmium, sulphide cell was simplest, 
but an open or short circuit failure could have produced a hard over 
signal to the attitude control. 

6. Accuracy - the claimed null accuracy for the silicon cell was .01°, 
later shown to be .017°. The demonstrated accuracy of the cadmium sul- 
phide was 0.1°. In addition, there was- a physical problem of matching 
cells and mechanical parts which made this hard to achieve. 

8. 2. 3.1 DEVELOPMENT PROBLEMS 

The remote sensors were procured by part number as an off-the-shelf item 

and no development problems were encountered. The following discussion 

pertains to the main sun sensor. 

SUN SENSOR TESTING 

Because of the difficulties of simulating the true sun's illumination 
(geometry, intensity, spectrum, and particularly a stable centroid of 
illumination) the Sun Sensor was tested for performance under simulated 
space thermal vacuum environment as exposed to the real sun. This 
"real sun" was as seen at Boulder, Colorado (or Tucson, Arizona) through 
a quartz optical quality window in the thermal-vac chamber which was 
mounted on a sidereal table to track the sun. Since the sun at Boulder 
was approximately 80 percent of the sun as viewed from space, correc- 
tions were applied to the Sun Sensor outputs based upon the output of 
a " standard" eye looking through the same ‘ thermal vacuum chamber window . 
This standard eye had been calibrated previously by Ball Brothers Re- 
search Company against the space sun on an Aerobee shot and subsequently 
recovered. Optical means were provided for viewing the sun directly 
and at the same time measuring the error between the normal to the 
mounting surface of the test fixture and the sun's line of sight. Both 


-to/; 



D2-114277-2 


the output and input were recorded on an X-Y recorder; the latter from 
a precision angle transducer mounted on the adjustable test fixture 
gimbal. This test was repeated for both the fine and coarse eye pairs. 
The peak output of the standard eye was recorded at the start and fin- 
ish of the test of each- axis; i.e., with the standard eye looking 
exactly at the sun. Typical calibration curves for the fine and coarse 
eyes are given in Figures 8-14 through 8-16. 

The Flight Acceptance Test vibration test setup for the Sun Sensor was 
conventional except for the use of a light source to stimulate the 
eyes during vibration. This light source was a commercial photogra- 
pher's light, Syl vania "Sun Gun." This light was used solely to sti- 
mulate the Sun Sensor outputs used in a "go-no-go" check for inter- 
mittents during vibration. This source was also used for incoming 
acceptance and spacecraft level tests at Boeing. 

The major problem areas in FAT testing of the Sun Sensor were test 
equipment or procedure oriented. 

1. "Unusual" weather for the Boulder, Colorado area reduced the 
available "good" sun time to such a low percentage that, late in 
the fall of 1965 an additional test facility was set up near 
Tucson, Arizona (a "Good" sun was defined as a sun with no clouds 
within 20 degrees of the sun line of sight) . 

2. It was found that great care had to be taken in cleaning and main- 
taining the precision mounting surfaces of the test fixture. 

Failure to keep these rigid requirements could lead to rejection 
of good Sun Sensors because of apparent misalignment between the 
reference mirror and the mounting plane. 

3. Because of the limited space in the back of the main Sun Sensor, 
great care had to be taken in installing the trim resistors to 
make sure that they were fastened across the correct sensing eye. 

A peak output test as used for Incoming Acceptance Test verified 
this proper connection. 

4- The white reflecting paint (JPL S-13) used on all surfaces to 

face the sun except the eye lens, was the source of two problems: 

(a) In the first few vacuum sun tests, this paint outgassed and 
clouded the quartz window with a projected image of the Sun 
Sensor (no paint deposited on the surface opposite to the 
eye lens which were not painted). A pre-performance test 
vacuum cycle to outgas the paint solved this problem. 

(b) The paint used was found to be very sensitive to proper 
mixing, application, part handling and the useful date life 
of the paint. New procedures were developed for proper care 
of the sensor during its entire ground test sequence to pre- 
vent paint chipping. Even with these procedures, there was 
a small amount of touch up necessary on the flight units. 
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8. 2. 3. 2 MISSION PERFORMANCE 

The sun sensors provided an accurate celestial reference for a variety of 
non-nominal situations. Approximately 60$ of the time was spent off the 
sunline and the capability of having fine, coarse, or both sun sensors in 
the loop proved extremely useful. 

The initial sun acquisition took place automatically on all missions within 
the maximum allowable time of 20 minutes from separation. 

Figure 8-17 shows a coarse pitch sun sensor calibration curve obtained 
during a thermal pitch maneuver away from the sun of Mission II. Figure 
8-18 is a yaw coarse sun sensor calibration curve based on yaw updates 
during the readout phase of Mission II. 

The coarse eyes proved to be very useful during photo readout on all missions. 
Nitrogen was conserved since the sun did not have to be reacquired every or- 
bit. Pitch attitude during most of readout was estimated from the initial 
pitch maneuver, knowledge of pitch drift rate, and solar array current. Yaw 
attitude, however, was continuously monitored via the coarse sun sensor. 
Attenuation of the yaw output due to pitch was approximately the same for 
all missions. At a pitch angle of 30°, yaw was observed to be degraded an 
average of 0.8. The predicted attenuation for this case is cos 30° or 0.866. 
Also, on all missions, moonlight was seen to affect the coarse eye output 
during certain portions of an orbit, but with no bad effect on the mission. 

8.2.4 CONCLUSIONS AND RECOMMENDATIONS 

1. There were no flight problems with the sun sensors. 

2. The aches and pains of obtaining flight qualified units according to 
schedule were considerable. A good calibrated artificial sun source 
would have saved calendar time as well as money. Substitution of a 
sun simulator for a Boulder, Colorado, or a Tucson, Arizona sun is 
recommended for future programs. 

3. Thermal control coatings used on the sun sensor caused trouble because 
of apparent misalignment between the reference mirror and the mounting 
plane. Great care had to be exercised to maintain clean mounting 
surfaces. 

4. Because of the limited space in the back of the main Sun Sensor, great 
care had to be taken in installing the trim resistors to make sure 
that they were fastened across the correct sensing eye. 

5. The use of pig-tail leads on each sensor, to provide direct connection 
to interfacing units, eliminated 5 connectors. This method of connec- 
ting the sun sensors is recommended to reduce the total spacecraft 
connector count. 
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NOTE: 
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FIGURE 8-17 INFLIGHT COARSE SUN SENSOR CALIBRATION 
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FIGURE 8-18 
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INFLIGHT COARSE SUN SENSOR CALIBRATION 
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Recommendations for "doing differently if one had it to do over" ares 

1. The wide angle sun sensor array should he calibrated over its full 
range prior to flight. A linear wide angle telemetry output would 
have been useful for the unanticipated "off-sun" mode of operation 
employed on Lunar Orbiter. 
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8.3 CANOPUS STAR TRACKER 

The Canopus star tracker (CST) used on the Lunar Orbiter program was devel- 
oped by ITT, Federal Laboratories. The CST was a part of the Attitude Con- 
trol Subsystem described in Section 3*0. It's primary functions were to 
provide: (l) a roll reference signal to the attitude control subsystem, 

(2) a star map signal which was proportional to the light flux entering the 
tracker for identification of Canopus via telemetry on the ground, and ( 3 ) 
a Canopus recognition signal to the programmer for mode switching of the 
attitude control roll reference. 

8.3.1 STAR TRACKER DESCRIPTION 

The primary element of the tracker was an image dissector phototube. A 
schematic is shown in Figure 8-19. A star was imaged by the lens upon the 
image dissector photocathode and an electron beam image' was formed by fo- 
cusing electrodes. Behind the photocathode was a narrow slot aperture 
which allowed only star image signals that passed through the aperture to 
enter the photo multiplier dynode chain to provide outputs. Deflection 
coils placed around the tube allowed electron beam images from the photo- 
cathode to be scanned across the aperture if appropriate currents were 
applied to the coils. 

Through this means of electronically scanning the electron image of a star, 
phototube output was modulated to provide error signals indicating star 
position. The narrow slot aperture was aligned with the vehicle roll axis. 
The tracker electronics generated a 14 Hz triangular wave form to sweep 
the full field of view in "search" mode. When sufficient output was ob- 
tained from the photo multiplier to trigger the "track" mode threshold, 
the scan frequency was changed to 800 Hz and the scan amplitude reduced to 
+ 1 °. 


Star position information was obtained and used in an internal feedback 
tracking loop to average the electron star image about the center of the 
aperture. The actual magnitude of the DC deflection voltage required indi- 
cated star position with tespect to the roll axis and this magnitude was 
provided as the output roll error voltage to the ACS. 

The electron beam which passed through the aperture was amplified in the 
dynode chain. The resulting current was proportional to the brightness of 
the star which was imaged. This video output provided the star map voltage. 
A recognition signal was generated based on the star map voltage above 1.2 
volts and below 4»4 volts. These levels corresponded approximately to l/3 
times to 3 times Canopus. 

8.3.2 DESIGN REQUIREMENTS 

The star tracker performance requirements (paraphrased from the latest 
revision of the specification) were: 

l) To track the star Canopus and provide a roll reference signal for atti- 
tude control. The roll error scale factor was 1 volt per degree and 
was required to be linear to + 2.5 deg and with an output over 2.5 
volts to + 4»1°. The tolerance allowed was + r Jp . 
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FIGURE 8-19 SCHEMATIC DIAGRAM OF IMAGE DISSECTOR TUBE 

AND LENS 
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2) To provide an analog star map signal to the telemetry subsystem which 
was linearly proportional to the light flux from the star being 
tracked. Operation after 6 hours in space and throughout the rest of 
the mission was required. 

3) To provide a Canopus recognition signal whenever a star of the proper 
brightness fell within a specified ratio of Canopus. The purpose was 
to automatically discriminate against other stars. The recognition 
gate levels were first specified to be .5 to 1.5 X Canopus. Later 
this was opened up to .3 to 3 X Canopus. It was also tailored to 
assure a margin for the star map voltage outside the recognition levels 

4) To provide a roll field of view of + 4-1 degrees. The roll field of 
view was to allow operation in a + 2 degree deadzone before, during, 
and immediately after occultation without losing the star due to gyro 
drift while in the rate integrate mode. 

5) To provide a yaw field of view sufficient to accommodate Canopus, for 

a 30-day photo mission plus the launch period associated with any given 
month. The yaw field of at least + 8 was provided. 

6) To provide a mechanical adjustment in the yaw plane (pre-launch) in 2 
degree increments to provide a total yaw field coverage of 33*5 degrees 

7) To provide a bright object sensor and shutter to protect the photo tube 
from illumination greater than .03 foot candle. The shutter closure 
time was less than .5 seconds. 

8) To provide dynamic response as follows: 

a) acquisition _of_ a star after entering field of view r ^ . 5 sec. 

b ) roll error signal time constant T = .14 + *05 seconds. 

9) Signal to noise ratio was required to be less than 24 to 1 at .1 de- 
gree roll error. The> noise output was required to be less than 15 arc 
seconds at null. At maximum roll error the noise was required to be 
less than 100 millivolts EMS. The necessity to specify the noise at 
maximum roll error was not recognized in the original specification. 

10) Tracking of Canopus to within 30 degrees of the bright limb of the 
moon was required. 

11) ' The weight was to be less than 7.5 lb. The original goal was 5.5 lb. 

12) The power was to be less than 3*0 watts at 21 volts or 5-0 watts at 
31 volts. The latter allowance was made to accommodate the design 
as it evolved. 

13) An alignment prism was required to permit measurement of the tracker 
alignment to within .05 degrees. 

14) A light shield intended to prevent light from the omni antenna from 
impinging on the lens of the tracker was required. The stated require- 
ment was to exclude illumination from light sources at angles greater 
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than 24.66° from the optical axis in the roll direction.. 

To telemeter the CST information to the ground for star map- interpretation 
and Canopus identification with a telemetry frame repetition rate of 23.9 
seconds imposed a requirement that the CST map and roll error signal be 
subcommutated at 8 times the frame rate, or approximately one data point 
every 3 seconds. Roll rate during star map maneuvers was normally l/2° 
per second. This combination assured at least 5 data points while cross- 
ing the + 4*1° required roll field of view. 

8.3.3 DEVELOPMENT AND OPERATION 

At the' time the design decisions were being made concerning the Lunar Orbiter 
Canopus star tracker the state-of-the-art was as follows: 

a) No spacecraft had actually used Canopus as an attitude reference. 

b) The Mariner IV Canopus tracker was under development at JPL. The 
Barnes Engineering Company was involved in manufacturing the design. 
Development problems included: 

1) Non-uniformity of the cathode of the CBS image dissector tube. 

Since discrimination of Canopus was based on brightness this 
affected the recognition gates. 

2) Manufacturing yield of the fiber optics used to adapt the star 
image in the focal plane of the catadioptric lens to the spherical 
photo cathode surface. Breakage or change occurred due to tempera- 
ture or vibration exposure. 

3) Tolerances on the analog electronics photo tube and uncertainty 
about the spectral calibration of the test source as compared to 
Canopus (as seen in space) caused lack of confidence in the design. 

c) The Surveyor Canopus tracker was under development by Santa Barbara 
Research Company. It used a motor-driven mechanism to scan the photo 
tube. The mechanical complexity and low predicted reliability ruled 
it out as a contender for the one year life mission desired for Lunar 
Orbiter . 

- d) The long range earth sensor that had been used successful l y on Mariner 
II mission to Venus was developed by JPL and the Nortronics Division 
of Norair Inc. It used a vibrating reed to provide mechanical scanning 
of a photo tube. The sensitivity with a wider field of view required 
in this application was not adequate and extensive modification would 
have been required. 

e) Narrow field of view mechanically gimbaleid star trackers were availa- 
ble from various missile programs. Typically they were used to align 
inertial guidance platforms and were not space qualified. 
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f) A narrow field of view star tracker was under development for the Orbi- 
ting Astronomical Observatory program at the International Telephone 
and Telegraph Federal Laboratory. A wide yaw field of view was re- 
quired for Lunar Orbiter to accommodate the angular excursion of the 
line of sight to Canopus relative to the normal to the ecliptic plane. 

In the following discussions the development will be related to discrete 
time intervals between the major program events. 

8. 3. 3.1 PROPOSAL SUBMITTAL TO PRELIMINARY DESIGN REVIEW 

The Barnes/JPL tracker was initially proposed for use on Lunar Orbiter. 
Reports of development problems indicated that de-bugging the tracker was 
a major task for JPL. 

It was desired to procure the star tracker from an expert subcontractor, 
to firm fixed price, and to have high confidence in the operation of the 
end product. A formal competitive vendor selection was made based on the 
requirements listed in 8.3.2. 

The ITT Federal Laboratories were selected to develop a new tracker. Early 
constraints on the design were: 

1) The ability to increase the optical field of view to 32 degrees in yaw 
and employ electronic gimballing within this field for search and track 
was required. This option was considered necessary to provide for 
tracker operation for the one year extended mission. When it was 
established firmly with NASA LRC that a Canopus referenced orientation 
was not necessary for the extended mission, this requirement was re- 
duced to that required for 30 days of operation at the worst time of 
year. 

2) Use of the CBS electrostatic deflection image dissector tube. Magne- 
tic deflection coils were used in the other ITTFL designs. An early 
desire was to keep the spacecraft magnetically clean. It was thought 
that the magnetic deflection technique could cause problems for a po- 
tential magnetometer experiment. This experiment requirement went 
away. As a consequence, when ITTFL ran into delivery problems with 
the CBS tubes because of inability to meet rigid cathode uniformity 
tests, a switch was made to their own tube. 

8. 3.3. 2 CRITICAL DESIGN REVIEW TO FIRST FLIGHT 

Many development problems with the Canopus Star Tracker became evident 
during the comprehensive test program. 

The formal portion of the test program included: (l) Flight Acceptance 

Tests, (2) a Qualification Test, (3) a Reliability Demonstration Test, and 
( 4 ) an Incoming Acceptance Test. These tests and some of the significant 
results are presented in the following paragraphs. 
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Canopus Star Tracker- Testing 

The parameters of the CST which were checked before and after each Flight 

Acceptance Test (FAT) are given below: 

a) Roll error versus Roll angle over the entire Roll/Yaw fields of view 
(+ 4*1 degrees and + 8.20 degrees, respectively). 

b) Star Map Telemetry output versus star intensity (expressed as times 
Canopus) over the entire Roll/Yaw FOV. 

c) Canopus Recognition output (attitude control and telemetry) versus 
Star Intensity (x Canopus). 

d) Roll Error Signal to Noise Ratio. The requirement was that this ratio 
must be greater than 24 : 1 ; all units had ratios greater than 30:1. 

e) Roll Error Noise at Max Deflection. In all cases, the noise level was 
less than the 100 MV RMS requirement. Typically the noise was less 
than 70 mV RMS. 

f) Sun Shutter Response. It was required to close within 0.5 seconds at a 
level of illumination equal to or greater than one x Moon (as seen by 
the CST at the 46 KM perilune). "Good" units typically had response 
times less than .3 seconds. The problems in setting the proper level 
of illumination to trigger the shutter, and in fabricating the shutter 
mechanisms are discussed below. 

g) Roll Error Frequency Response. The requirement was not stringent; the 
time constant was to be less than 0.16 seconds. 


The FAT Vibration tests were similar to those described for the IRU, Section 
8.1. Problems with Sun Shutter operation and Roll Error hull alignment re- 
sulted in a reduction in the required sine wave vibration levels. These 
reductions • (to the same levels as for the IRU) were based on the results of 
a special test of a dynamic model of the spacecraft, which demonstrated 
that the actual vibration environment was less than originally estimated 
and specified. The random level requirements were not changed. 

The CST was subjected to periodic solar illumination to check Sun Shutter 
operation during thermal vacuum tests and to continuous star illumination 
(at 1 x Canopus) so that Roll Error, Star Map and Canopus Recognition out- 
puts could be monitored for intermittents . 

The Qualification tests were similar to FAT except that the- vibration re- 
presented the predicted 3 a mission values rather than the nominal values. 

No change was made in the random levels. Also electromagnetic interference 
(EMI) and humidity tests were added. 

The Reliability Demonstration test, originally specified as two 30 day mis- 
sion simulations performed on a CST which had first passed FAT, was reduced 
to one launch vibration simulation, and one 30 day thermal vacuum simula- 
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tion with CST "events" equivalent to those in the original 60 days or ther- 
mal vacuum squeezed into the 30 days. 

The performance tests run before and after the vibration, and before and 
after thermal vacuum were the same as for FAT. The deviations in Roll Error 
"Gain" (Roll Error vs Roll Angle), Roll Error Null (output at zero input), 
and Star Map Telemetry versus time were monitored. 

Incoming Acceptance tests were run at Boeing to check the integrity of each 
CST after FAT at ITT and before installation on the spacecraft. In these 
tests, the CST was illuminated using an ITT-furnished Star Tracker Test Set 
(STTS). The tracker with test set attached is shown in Figure 8-20. The 
parameters checked in IAT were the same as the basic parameters checked in 
FAT. 

Component Test Problem Areas 

High Voltage Arcing - Although the first tracker passed its FAT test with 
adequate margin, its electronics were inadvertently destroyed by arcing in 
the high voltage power supply in a subsequent test when it was turned on, 
by error, at a pressure 10“ 5 mm. of mercury as the thermal vacuum chamber 
was being evacuated. This danger had been recognized and turn-on in the 
L.O. mission was delayed for six hours after launch. Operator error allowed 
the warnings in the test procedure to be missed. 

Two other trackers were subsequently damaged by arcing even when procedures 
to delay turn on until a pressure of 10” 5 mm. of Hg was reached. Slow 
bleed off of gases from the potting compound around the tube caused the 
problem. The gas was trapped in pockets formed by a mylar film which was 
wrapped around the trackers for reflective insulation. Final solution to 
the problem was reached when the CST was vacuum cycled after potting, the 
reflective film was loosely wrapped, the tracker cover vents were increased 
and the soak time at 10“ 5 mm. of Hg in the thermal vacuum chamber was in- 
creased to three hours before turn on. 

Sun Shutter Sticking - The operation of the sun shutter was found to be 
erratic following FAT vibration of the second tracker. It would some- 
times fail to open after illumination of the Bright Object Sensor (BOS) had 
closed it to protect the image dissector tube. Insufficient clearance be- 
tween the shutter and its housing, inadequate stiffness of the solenoid 
shaft and of the shutter blade, and excessive amplification of tracker vi- 
bration inputs at the shutter location were the causes of this problem. 

These were not completely identified and solutions implemented until the 
Qualification Test tracker was modified. Solutions included structural 
stiffening of the shutter blade and of the entire tracker frame with epoxied 
stiffeners, addition of a butyl rubber damping pad between the tracker struc- 
ture »nd spacecraft structure, and a change in the damping coefficient of 
the silicone rubber used to pot the image dxssector tube to the magnetic 
shield which, in turn, was potted to the tracker structure. 

Tracker Alignment Shifts - Along with the sun shutter sticking problem, it 
was determined that the vibration (and thermal cycling) of the tracker was 
causing the Roll Error null plane to shift relative to the front face and 
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Figure 8-20: CANOPUS STAR TRACKER WITH TEST SET ATTACHED 
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reference prism. The problem was identified as motion between the image 
dissector tube and the support structure caused by excessive vibration 
strain and thermal distortion. Magnetic fields induced in the tracker 
structure by the large DC field surrounding the vibration shaker also 
caused null shifts. 

Solution to this and the sun shutter sticking problem was realized by the 
same actions which included reduction of vibration amplification of the 
tracker structure through use of stiffeners and dampers as described above , 
and reduction of thermal distortion and image dissector tube vibration 
amplification relative to the structure by changing the potting compound 
from R TV-106 to RTV— 11. Vibration levels at the tube were reduced from 
over 100 g's (in response to a 15 g tracker input) to less than 30 g's. 

It is of interest, and a tribute to the integrity of the ITT tube and 
electronics, that there were no failures of these elements during the diag- 
nostic vibration tests where the extreme amplification levels were en- 
countered. Thermal distortions of the Roll Error Null were reduced from 
over 0.3 degrees to less than 0.1 degree by changing the potting compound 
and by temperature cyling it before final alignment. Magnetically induced 
shifts were minimized by degaussing the tracker periodically and replacing 
all "hard" magnetic materials in the tracker structure with "soft" or non- 
magnetic materials. 

Star Map Gain - In spite of increasing "burn-in" time to 100 hours of expo- 
sure for each image dissector tube to illumination of intensity 5 times 
Canopus, the tubes continued to show degradation of video output with time 
when exposed to illumination as low as 1 x Canopus. This degradation was 
as much as 2. 5 si in the RDT unit during both 15-day cycles even though it 
was retrimmed after the first cycle. The degraded tubes also showed a re- 
covery, or healing, tendency when not illuminated and when turned off. 

The mechanism was and is not understood and no solution was or has been 
effected other than frequent recalibration. The flight experiences with 
this phenomenon are discussed later in the section on flight data. 

Simulated Star Source (SSS) Calibration - The process of calibrating the 
SSS to represent Canopus as seen by the S-ll image dissector tube consisted 
of: 

a) Measuring the intensity and spectrum of the GE quartzline lamp as seen 
through the color filter. 

b) Analytically applying a correction factor for the optics of the SSS 
and tracker and for the S-ll photocathode in order to calculate the 
necessary size of the aperture. 

c) Analytically applying a very small correction factor to rating of the 
neutral density filters to account for the measured deviations from 
the 20 nominal logrithmic steps from 5 x Canopus to 0.1 x Canopus. 

As the result of comparisons between the output of a tracker in response 
to illumination by the two ITT-produced SSS's (one at ITT and one at Boeing) 
and to the JPL SSS it was determined that there were errors in the calibra- 
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tion calculations for the SSS's at ITT and Boeing which resulted in them 
producing an output 30 percent too high. These errors were discovered and 
the flight trackers recalibrated before the second L.O. flight. The fact 
that the recalibrated results were right and the correlation of ground test 
and flight test Star Map telemetry outputs are discussed in the section of 
the L.O. mission results. 

Star Tracker Test Set (STTS) Calibration - Although the original design re- 
quirements for the STTS called for interchangeability between all trackers 
and STTS's, it was discovered that the spectral responses were not well 
enough matched nor stable enough to serve as a secondary standard for 
checking Canopus intensity during various tests. In an attempt to circum- 
vent some of these difficulties the approach taken was to "marry" each 
STTS to a tracker by calibrating each of the five star sources of the STTS 
against the SSS at ITT, using the particular tracker as a transfer standard. 
The STTS was then delivered to Boeing with the tracker and Boeing used them 
as a matched set throughout IAT and spacecraft testing. It was found that 
the intensity of the STTS illumination varied with time in an unpredictable 
manner and although the STTS proved to be a reliable stimulus for Roll 
Angle, it could not be used as a reliable stimulus for star intensity even 
though the intensity control was calibrated against the SSS filters. In 
the end, the STTS was used in a "go-no-gc" test of star map output (which 
was what it was originally designed to do), and the flight trackers were 
returned to ITT for star map calibration just before the spacecraft were 
placed on the booster. 

8. 3. 3. 3 MISSION PERFORMANCE 


Mission I 


During the initial phases of Mission I the star tracker failed to operate 
as expected because of excessive light flux into the optics. This "glint" 
problem occurred while attempting to produce a star map that could be used 
to determine a precise attitude baseline for a midcourse maneuver. The 
initial star map is shown in Figure 8-21. Also shown in the same figure 
is the computer predicted a priori map. After numerous commanded maneuvers 
in the attempt to determine the source for the apparent interference, a 
decision was made to use the Moon as a celestial reference. The high gain 
antenna pattern "map" was used to confirm the roll orientation. The out- 
come of the 37.8 meter per second midcourse was successful which placed 
the spacecraft on such a precise trajectory that a second midcourse was 
not needed to achieve the injection point for transfer to the initial 
ellipse three days later. Subsequent operation of the star tracker in 
the shadow of the moon was considered normal except for the low map signal 
voltage sensitivity. Earlier test and development work with the tracker 
had indicated that prolonged exposure of the tracker to bright light with 
the tracker turned on caused degradation of star map gain. Since the 
tracker was on continuously for 60 hours during which time it was exposed 
for 2 3/4 hours to the moon in addition to locking on stray light the 
remaining time, it was felt that this was probably responsible for the 
low sensitivity. 


142 


D2-1 14277-2 



FIGURE 8-21 CANOPUS STAR TRACKER STAR MAP 
L. O. I GLINT PROBLEM 
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A Space Glint Test (see Figure 8-22) showed clearly that the omni antenna 
was a major contributor to the stray light which impinged upon the Canopus 
tracker. An interesting facet of the glint problem was that the tracker 
invariably locked onto light reflected from the baffles on one or the 
other side, resulting in either plus or minus roll saturation. Negative 
roll saturation was generally associated with a higher map signal output, 
probably because the antenna reflected directly onto the baffles in the 
negative side of the tracker while the baffles on the positive side were 
lighted by indirect reflections. 

A number of ground tests to investigate the sources of stray light inter- 
ference with the Canopus Star Tracker observed during Mission I were 
initiated. One of these tests was conducted using Spacecraft No. 1, shown 
in Figure 8-23, showed that the Omni antenna gave a stray light flux 
sufficiently high for the tracker to switch from search to track mode. 

In addition, it was found that the stray light flux due to multiple re- 
flections from the equipment mounting deck was high. The purpose of the 
tests was to obtain quantitative data on the corrective measures proposed 
to be incorporated on the second flight spacecraft. 

As a result of these tests, it was recommended to paint black the Omni 
antenna, the edges of solar panel #2 and #4, and portions of the backside 
of the solar panels. These fixes lowered the interference to 23 % of the 
danger level. The tests also indicated that further reduction could be 
achieved by light shields mounted to the Equipment Mounting Deck or the 
top of the solar panels. A summary of the glint data is given in Figure 
8-24. 


Mission II 


Spacecraft changes incorporated prior to Mission II were: l) Omni antenna 

painted gloss black, and 2) edges and backside of solar panels 2 and 4 
painted flat black. 

On Mission II the Canopus Tracker was first turned on approximately 6 hours 
into translunar flight. The tracker acquired and tracked Canopus immediately, 
indicating the spacecraft was oriented toward Canopus at that time. This 
was verified by making a 360 degree star map and by a high gain antenna signal 
strength map. The roll error from Canopus was then used in a closed loop 
mode until the midcourse maneuver. The Canopus Star Tracker appeared to be 
working properly in full sunlight. 

The first star map matched the a-priori map fairly well except for the 
appearance of a broad (approximately 50 degree) object which had a peak 
map signal strength of about 4 volts. At this time, the earth had a clock 
angle (defined as the angle about the sun line from Canopus) of 130 degrees 
and a cone angle (defined as the angle away from the sun line) of 140 degrees. 
It was determined that the earth, which was 30 degrees out of the field of 
view in cone angle, was the source of the stray light. The apparent lag in 
cone angle of the peak signal strength was consistent with the location of 
the low gain antenna. 
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Figure 8-23: GROUND GLINT TEST IN PROGRESS 
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SPACECRAFT #1 - NO MODIFICATIONS 


SPACECRAFT #1 MODIFIED TO REDUCE INTERFERENCE 


INTERFERENCE LEVEL INITIAL* 



FINAL* 

1. OMNI ANTENNA & BOOM, 
PAINTED WHITE 

1.09 

1 . 

OMNI ANTENNA BOOM, GLOSS BLACK, 
DISCS FLAT BLACK 

0.027 

2. SOLAR PANEL #2, 

EDGE NOT PAINTED 

0.068 

2. 

SOLAR PANELS #2 & #4, EDGES 
TAPED BLACK, BELOW NOISE 
LEVEL 

— 

3- SOLAR PANEL #4, EDGE 
NOT PAINTED 

0.021 

3- 

HI GAIN ANTENNA, BELOW NOISE 
LEVEL 

— 

4. HI GAIN ANTENNA 

(MULTIPLE REFLECTIONS'! 

0.035 

4. 

E M D (MULTIPLE REFLECTIONS 
SOLAR PANEL, TOP FLAT BLACK, 
EDGE TAPED BLACK) 

0.21 


5- E M D (MULTIPLE REFLECTION) 0.40 
SOLAR PANEL TOP FLAT 
BLACK, EDGE NOT PAINTED 

TOTAL 1.614 TOTAL 0.237 

* NUMBER GIVEN AS RATIO OF LIGHT FLUX TO CAUSE A STAR TRACKER TO SWITCH FROM SEARCH TO TRACK 

RESULTS OF GROUND GLINT TESTS 
FIGURE 8-24 
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Just prior to midcourse, the propellant squib valves were fired. Immediately 
thereafter, Ganopus track was lost and the attitude control system went into 
inertial hold in roll. This resulted in a delay of the midcourse maneuver 
while a second star map was made. 

The second star map, shown in Figure 8-25 matched the a-priori map fairly 
well but minor glint from the earth was again evident. In this case, however, 
the maximum signal due to earth glint was down to 1.1 volts due to the greater 
earth range. After the second map, the Canopus Tracker continued to track 
Ganopus but it was not used in a closed loop mode to control attitude. In- 
stead the roll axis was controlled by the gyro and maneuver commands were 
transmitted to the vehicle as required to maintain Ganopus in the field of 
view and to zero the roll error in preparation for Midcourse, injection, 
and transfer maneuvers. 

The injection maneuver occurred during sunset. Immediately after sunrise, 
Canopus was lost due to reflections of moon light. A subsequent experiment 
established that Canopus could not be tracked reliably in lunar orbit and 
that continued exposure to moon light would degrade the Canopus Tracker map 
signal voltage. As a result, it was concluded that the Tracker should be 
operated only during sunset. 

After transfer to the final orbit, during photography and readout, the 
method of roll control adopted was: 

(a) Turn Tracker on after sunset. 

(b) Acquire Canopus in closed loop mode to update roll attitude. 

(c) Turn Tracker off before sunrise. 

The method worked well with reasonable nitrogen consumption rates and 
minima l operational problems. 

Mission III 

Results of the first star map on Mission III were uncertain because of data 
loss during the maneuver, however, a second 360 degree roll, shown in Figure 
8-26 was successful in establishing a roll reference. The spacecraft was 
rolled +125 degrees to Canopus and a tracker off-on cycle was performed to 
observe and track the star. 

Canopus was tracked throughout the translunar flight but without the error 
signal being used by the attitude control in a closed loop mode. The tracker 
lost Canopus six times during this period, once when the squibs were fired, 
four times with no apparent spacecraft disturbance, and once just prior to 
injection when the moon albedo caused a pronounced glint problem. Each 
time track was regained by commanding the tracker off-on cycle. 

Star map signal was initially 3*7 volts, decayed to 2.6 volts through trans- 
lunar and recovered to 3.25 volts by the end of the mission. Following in- 
jection the tracker was operated only in the dark. 
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TELEMETRY DATA STAR MAP TABULATION 


T/MNO. SIDL NO., NAME 

CLOCK ANGLE 
APRIOR1 OBSERVED 

CANOPUS 
FLUX RATIO 

MAP VOLTAGE 
APRIORI ACTUAL 

1 

13, 

BE CRU, MIMOSA 

311 

310 

0.16 

0.7 

1.22 

2 

8, 

AL CRU, ACRUX 

316 

314 

0.38 

1.4 

1.30 

3 

74, 

TH CAR 

326 

326 

0.04 

* 

1.02 


( 61, 

IO CAR 

335 ) 


0.06 

* ) 


4 

i 28, 

BE CAR, 


337 



1.06 


l 

MIAPLACIDUS 

335 ) 


0.09 

* ; 


5 

2, 

AL CAR, CANOPUS 

0 REFERENCE 

1.0 

3.9 

3.5 

6 

.601, 

EARTH 

96 

40-120 

3.ixl0 7 

* 

1.38 

* 

NO DATA 








MANEUVER ANGLE (DEGREES) 

FIGURE 8-26 MISSION III TELEMETRY DATA STAR MAP 
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During sunset of the fourth orbit, Canopus was acquired in the "closed loop" 
mode. For the remainder of the photo mission the operational procedure was 
to acquire Canopus during sunset and operate the roll axis in the closed 
loop mode. Star maps were performed three more times during Mission III. 
Results of these maps agreed well with the a priori maps. 

Mission IV 


The Canopus Tracker was first turned on approximately seven hours into 
translunar flight. It was locked on positive glint at that time and re- 
mained there throughout the first star map maneuver. The star map voltage 
was consistently high, and averaged about 3 volts. Two hours later the 
tracker was turned on in a negative glint condition and a second +360 
degree star map maneuver was performed with similar results. Two blips in 
the star map voltage were noted at 75 degrees indicating that the tracker 
had viewed a celestial object. The spacecraft was rolled +84 degrees to 
view this object and a tracker off-on cycle was performed and the star was 
tracked successfully. The third star map and the high gain antenna signal 
strength map verified that the tracker was tracking Canopus. 

Canopus was tracked without acquisition for one hour prior to injection. For 
the remainder of the photo mission the operational procedure was to turn the 
tracker on without acquisition once or twice an orbit to obtain a roll re- 
ference and update roll attitude prior to a photo sequence. On those 
occasions when the tracker was locked on glint, track was usually regained 
by performing an off-on cycle. 

The orbit for Mission IV was nearly Polar with a period of approximately 12 
hours. As a consequence the spacecraft operated in full sunlight for long 
periods and large illuminated areas of the moon regularly came within view 
of the tracker. 

The Bright Object Sensor was closed for approximately 59 hours during the 
latter part of the mission. 

The star map signal, was initially 2.5 volts, decayed to 2.1 volts and re- 
covered to approximately 2.4 volts by the end of the mission. 

As a consequence of the Canopus Star Tracker anomalies observed during 
Mission IV additional tests were conducted (similar to those conducted after 
Mission I) to define possible glint sources on the spacecraft. These tests 
indicated that the power resistor dissipation panel on the omni antenna 
was a bright point source of glint in the Star Tracker baffle field of view. 
In addition, the stray light flux reflected from the equipment mounting deck 
to the backside of number 4 solar panel (painted flat black) was high. 

It was therefore recommended that the resistor panel be shielded, that the 
number 4 solar panel be painted gloss black, that the solar panel stowing 
lugs be painted. flat black, and that all the unpainted screws, etc., on 
the resistor panel be painted black. 
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Diagnostic analyses of the star tracker internal design were also initiated 
at Boeing because it was evident from flight experience that the changes 
to the spacecraft were ineffective in solving the problem. Design data 
were obtained for the lens and sunshade baffles. Lab tests were conducted 
of the electronic scanning. The analyses showed that the baffle edges 
were effectively inside the imaged field of view and that the electronically 
scanned field was + 11.2°. This information was not available soon enough 
to effect any changes in the star tracker for spacecraft V. 

Mission V 


The Canopus tracker was first turned on approximately seven hours into 
translunar flight. Initially it was in the track mode indicating a roll 
error of minus 3.2 degree and a map signal of 1.12 to 1.18 volts. This 
star was later identified as Acrux (a Crucis). The star was tracked for 
approximately two minutes at which time the roll error went to positive 
saturation due to 11 glint"'. Prom this point on the story was essentially 
a repeat of Mission IV, but with different details. 

The next unexpected event occurred approximately 9 hours prior to the end 
of the primary photo mission of L.O. V. The deadzone was opened and drift 
tests in pitch, roll, and yaw were started. On three occasions thereafter, 
the tracker was turned on and the bright object shutter was closed. This 
data clearly showed that the tracker was extremely sensitive to glint as a 
function of yaw attitude. Each time the spacecraft was yawed toward the 
Sun .75 degrees the bright object shutter closed. This corresponds to 
the tracker centerline moving from 84 degrees to the sunline to an angle 
of 83.25 degrees. 

The star map signal was initially 2.4 volts, decayed to 2.1 volts and 
"healed 11 to approximately 2.9 volts by the end of the mission. 

The Bright Object Sensor and Canopus Presence Signal Gates worked as expected 
on all missions. A summary of "on" time in space and number of ON-OFF cycles 
for each tracker is given in Figure 8-27. A summary of "glint" problems is 
presented in Figure 8-28. 

8.3.4 CONCLUSIONS AND RECOMMENDATIONS 

Proper operation of an orbiter spacecraft with a wide field of view optics 
on a star tracker required considerably more attention to details of the de- 
sign and the configuration than was expended on the Lunar Orbiter Canopus 
tracker. The following points are important and need be considered more 
seriously: 

1) Broad sources of diffuse light, such as a nearby planet, are 
potential glint problems that must be analyzed carefully. 

2) Location of spacecraft elements which may be illuminated and be 
within the field of view of the baffle, required careful analysis. 

3) Sun shade design must be such that edges do not appear in the 
imaged field of view. 
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MISSION 

ON-OFF 

CYCLES 

TOTAL HOURS 
ON TIME 
IN SPACE 

PRELAUNCH 
MECHANICAL 
SETTING * 

I 

133 

68.0 

83.0° 

II 

252 

162.5 

98.2° 

III 

299 

118.3 

98.2° 

IV 

145 

39.8 

81.5° 

V 

229 

80.75 

84.0° 


* SUNLINE TO TRACKER CENTERLINE 


FI GORE 8-27 TRACKER ON-OFF HISTORY 
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LO I, IV, & V - BORESIGHT TOWARD SUN 

o STAR MAP VOLTAGE INITIALLY HIGH - DEGRADED WHEN CST WAS ON - RECOVERED 
IN TIME 

o TURN CST OFF./ON WHILE LOOKING AT CANOPUS TO ACQUIRE 
o USED HIGH GAIN ANTENNA AS ATTITUDE CHECK AND BACKUP 
o USED MOCN FOR LUNAR ORBIT INJECTION ROLL REFERENCE ON L.O. I 
o TURNED CST OFF DURING SUNLIT ORBIT PERIODS, GYRO IN RATE INTEGRATE 
MODE 

O UPDATED GYRO ROLL ATTITUDE WITH CANOPUS TRACK DURING SUN OCCULTATION 
o PERFORMED EXPERIMENT TO SHADE OMNI ANTENNA, AND IDENTIFY GLINT SOURCE 
ON L.O. I 

o SUNLIGHT CLOSED BRIGHT OBJECT SENSOR ON L.O. V AT SMALL ANGLE TOWARD 
SUN 

LO II & III - BORESIGHT AWAY FROM SUN 
o GLINT REDUCED FROM L.O. I 
o INITIAL STAR MAP“WITHIN 10# OF GROUND TEST 
o SUNLIGHT DEGRADATION TESTED BY TURNING CST ON ONLY DURING SUN 
OCCULTATION 

o ROLL ERROR CHECKED WITHIN TELEMETRY ERROR FOR 360° MANEUVERS 


FIGURE 8-28 

SUMMARY OF STAR TRACKER GLINT & IMAGE DISSECTOR TUBE DEGRADATION 
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4) A criteria to minimize stray light effects would be to prevent all 
second bounce light from entering the tracker lens. The Lunar 
Orbiter baffle design excluded only first bounce light at best. 

5) Electronic* sweep of the field of view should be limited to prevent 
"seeing” baffles or other mechanical edges. 

6) Mechanical adjustment of tracker boresight requires careful scrutiny 
to assure that the sunlight does not enter the sun shade or that 
illuminated surfaces are not brought into the optical field of view. 

7) The Star Tracker Test Set was found to be the cause of many of the 
problems associated with testing of the Canopus Star Tracker. The 
angular error measurements were accurate, but the intensity levels 
for calibration of the star map signal could only be used for "go” 
or "no-go" testing. 

8) Star Tracker image dissector tubes are subject to output degradation 
(and healing) in the long term presence (or absence) of illumination 
at star intensities. Physical phenomenon and solution are not 
clearly understood. 

Recommendations for "doing differently if one had it to do over" are to develop 
the technology which would allow a better analytical and hardware evaluation 
of the following: 

1) Star simulation for calibration of the sensor. 

2) "Bright object" simulation of nearby planets. 

3) Spacecraft level glint simulation. 

4) Dark room glint suppression. 

5) Star Tracker component evaluation under realistic operating 
conditions. 
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Figure 8-29: FLIGHT ELECTRONICS CONTROL ASSEMBLY 
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8.4 FLIGHT ELECTRONICS CONTROL ASSEMBLY 

The Plight Electronics Control Assembly, shown in Figure 8-29, interfaced 
with each spacecraft system to control all timing and sequencing of space- 
craft events. All elements of the G&C system were interlinked by this unit 
and functionally it was a part of each of the four G&C subsystems discussed 
in Sections 3.0 through 6.0. The weight of the assembly was 18.13 lbs. 

The average power used in sun (at 32 volts) was 42 watts; the power used 
at night (21 volts) was 32 watts. This assembly consisted of two distinct 
sections, the Programmer and the Closed Loop Electronics (CLE). The Pro- 
grammer was a low-speed digital data processor, with memory capacity large 
enough to provide 16 hours of control from stored commands and a 29.1“ hour 
clock. The Closed Loop Electronics, which was basically all analog in 
operation, performed the task of attitude control. It accepted error 
signals from the gyros and sensors to control the reaction thrusters and 
thrust vector control actuator in response to mode commands from the Pro- 
grammer. These two sections, Programmer and CLE, will be discussed in- 
dividually in the following paragraphs. 

8.4.1 PROGRAMMER DESCRIPTION 

The Programmer portion of the Flight Electronics Control Assembly was a 
serial data processor, operating at a bit rate of 2.4 KHz. The programmer 
contained a 21 bit, 128 word memory. The unit could execute either real 
time or stored program commands. Commands transmitted from the ground 
could provide for program updating, revising, or initiating the program 
routine as the mission progressed. The programmer is shown in the functional 
block diagram of Figure 8-30. 

The programmer has a hard line input function which controlled two modes of 
the system for ground checkout. One mode prohibited execution of the stored 
program, but allowed memory loading and verification. Discrete real-time- 
commands could override this control. The second mode allowed normal 
execution of stored commands, real-time-commands, memory loading and 11 
spacecraft functional interrupts. 

The Programmer is described by discussing the functions of the individual 
blocks shown in Figure 8-30. 

Signal Conditioner - provide input and output circuit isolation, proper 
external voltage levels, noise suppression, and minimized susceptibility to 
radio frequency interference. 

Command Register - This 20 bit register held stored program commands from 
memory or real— time— commands from the command decoder and provided complement- 
ed and uncomplemented , parallel outputs to the output matrix decoder. The 
register also held time, velocity or attitude constants for comparison with 
integrated values during event timing and maneuver sequences. 

Mode Control Register - The mode control register accepted command infor- 
mation and nine signal interrupts from spacecraft telecommunications, two 
occultation signals from the attitude reference subsystem, and one from the 
photographic subsystem. It set up the flight programmer for? 
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FIGURE 8-30 PROGRAMMER BLOCK DIAGRAM 
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1) Real time or s tor ed-pro gram operation; 

2) Interrupt commands (stop stored program and execute new command word); 

3) Information requests (telemetry and spacecraft time). 

Incut Parity Checker - The input parity checker checked the command words 
transmitted from the ground through the communications command decoder for 
even parity. 

Function Control Register - The function control register held the present 
five-bit operation code and functional mode of the programmer and combined 
them with timing to direct the information flow. The function control re- 
gister also controlled changes in the programmer operating mode. 

Adder - This unit was a half-adder and had logic circuitry which added one 
bit at a time to a value stored in the memory. The adder was used to add 
time, position and velocity increments, and to increment addresses. 

Velocity Conversion Register - The velocity conversion register detected 
the difference between two input frequencies. The sum of the two fre- 
quencies was constant; the difference rate was variable and proportional 
to the acceleration measured by the accelerometer. The difference fre- 
quency was scaled into 0.1 foot-per-second increments for midcourse and 
orbit insertion velocity changes. 

Memory Address Register - Seven address bits, held in this register, con- 
trolled the addressing of words read in or out of the memory. Addressing 
of special-purpose memory words, as commanded by the function control re- 
gister, override!, but did not destroy, the contents of the memory address 
register flip-flops. This technique allowed all indexing and address- 
modification-registers to be contained in the memory instead of external 
flip-flop-registers . 

Memory — The memory consisted of a magnetic— core plane with associated dis- 
crete part read-and-write circuitry. The memory contained 128-word storage 
which could be randomly selected. Read in/readout of the 21— bit word was 
serial, controlled by an internal counter. The basic bit cycle was read/ 
modify /write. The memory accepted data from the command register and adder. 
Eight specific word locations were employed as spacecraft time-accumulation- 
register magnitude-integrating-register , next instruction-address-register, 
store program word-address-register. Sun and Canopus occultation time record- 
ing registers, interrupted instruction and address-register, and telemetry 
word-transfer . The use of these special word locations reduced the number 
of active circuit registers. This resulted in a reduction of power con- 
sumption and weight. 

Voltage-to-Ereauencv Converter - The voltage-to-frequency converter accepted 
an analog rate voltage from the gyros in the inertial reference unit, which 
it converted to equivalent digital pulses. The digital pulses were inte- 
grated during a maneuver and compared to a constant value corresponding to 
the desired maneuver. Equality terminated the maneuver command. 
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Parity Generation and Checking - This unit provided buffering between the 
memory and the programmer logic. The parity generator provided an even 
parity bit in bit— position 21 for words transferred into memory. An even 
parity check was performed on the words transferred out of memory. 

Comparator - The comparator provided serial comparisons between a constant 
value from the command register and an incremented value from memory. 
Twenty-bit time words, and 15-bit attitude and velocity magnitude words 
were compared. When comparison was reached, the comparator provided a logic 
signal which caused the programmer to proceed to the next instruction. 

System Clock - There were two crystal oscillators in the programmer (for 
redundancy). Each oscillator drove a countdown register from which all pro- 
grammer frequencies and timing were derived. The crystal oscillator was 
assembled with discrete parts and provided a basic 6I4.4 KHz output frequency. 
The oscillator provided an extremely stable, jitter-free clock frequency with 
an accuracy of 1 part in 10^. The countdown register generated 0 to plus 4*5 
v.d.c. square-wave trains of the following frequencies: 614.4 KHz; 307.2 KHz; 

153*6 KHz; 76.8 KHz; 38.4 KHz; 19.2 KHz; 4*8 KHz; 800 Hz; 100 Hz; 50 Hz; and 
10 Hz. 

Redundancy Control - The redundancy control provided switching, in event of 
failure, between the two countdown registers. Control was exercised by a 
real-time command from the command decoder. 

Output Matrix Decoder - Decoding matrices and necessary logic elements pro- 
vide unique commands and signal formats to all required spacecraft subsys- 
tems. Pulse commands, on-off commands, timing bursts, and gated sequences 
were formed in this unit and were sent to the signal conditioning unit for 
output. 

High level signals and their drivers were electrically and physically iso- 
lated from low-level signals and devices. High-level signal circuits were 
enclosed in the Switching Assembly which is discussed briefly in paragraph 
8. 4.3* 2. 

Flight Control Switching - Commands from the output matrix decoder, and Sun 
and Canopus presence signals were combined to provide mode commands for the 
attitude control subsystem in roll, pitch, and yaw axes, as well as turning 
the IRU on or off, switching the gyros between rate or rate integrate modes, 
and turning the accelerometer "on" or "off" (actually this latter only closed 
or opened the rebalance loop). Accelerometer excitation and temperature con- 
trol were always "On" whenever IRU power was on. 

DC to DC Converter - Converted spacecraft voltage (+ 32 to + 21 vdc) into 
plus 4*5 volts, plus 6 volts, plus 15 volts, and minus 15 volts for the 
integrated logic circuits, memory and signal conditioning. The converter 
provided voltage to the switching assembly and + 15 and - 15 volt signal 
reference voltage to the thrust vector actuator. 

Command-Word Format - The ground-transmitted command word consisted of 22 
information-bits. The order of transmitting the information word began with 
the least significant bit. The ground-transmitted word format was received 
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by the command decoder, verified and transferred to the programmer on re- 
ceipt of an execute tone. The 22nd bit was a parity bit which was checked 
as the command was transferred into the programmer. The first bit was used 
to identify either a stored-program mode or real time mode of operation and 
was separated out as the word was transferred from the command decoder and 
used to set up the proper execution of the word. Word format is illustrated 
in Figure 8-31. 

Instruction Sets - Command word instructions were separated into two sets: 
those instruction words that control internal functions of the programmer; 
and those instruction words that control other spacecraft subsystem func- 
tions. 

Internal Instructions - The internal operation performed was designated in 
the command word by bits 2 through 6. The 9 internal codes were: 

1) Telemeter Memory (TEM). This command was used to verify specific stored 
commands . 

2) Wait Time (WAT). This instruction was used as a delay between stored 
commands . 

3) Compare Time (COT). Instruction was used to initiate an event at a 
desired spacecraft time. The address was indexed each time the command 
was executed. 

4) Execute Magnitude Minus (EMM). A magnitude command with a minus sign 
to control the maneuver direction. 

5 ) Execute Magnitude Plus (EMP). Same as EMM except for sign. 

6) Store Program Address (SPA). Command designated the address where the 
next stored program word transmitted from ground was to be stored. 

The address was indexed each time a stored program word was received. 

7) Terminate (TEIR). A real time command used primarily as a backup command 
to stop a comparison of time or magnitude. 

8) Jump (JMP). The stored program under execution was interrupted and 
the programmer jumped to the address designated. 

9) Jump Modified (JPM). Same as jump except the address was indexed and 
there was no limit to the number of repeated executions. 

External Programmer Commands - Seven operation codes provided magni tilde 
commands, and six operation codes provided discrete functions in indepen- 
dent order. All spacecraft commands could be issued as real time or stored- 
program commands . Description of the external codes follows : 


161 


COMMAND WORD FORMAT 


o 

N) 


'22 1 21 Yi 6 . . .~?rn 

BIT NUMBER (1-22) FUNCTION AND STATE 

1 TRUE: REAL TIME COMMAND FALSE: 

2 THRU 6 OPERATION CODE 

6 TRUE: S/C FUNCTIONS FALSE: 

7 THRU 21 MANGITUDE OR FUNCTION TO BE CONTROLLED 

22 EVEN PARITY-GENERATED ON THE GROUND 

TIME WORD FORMAT 

mm t ti'g ♦ . . am 


STORED PROGRAM COMMAND 
PROGRAMMER FUNCTIONS 


BIT NUMBER (l-22) FUNCTION AND STATE 

1 FALSE: STORED PROGRAM COMMAND 

2 THRU 21 TIME: 0 to 29.1 HOURS 

THIS VALUE WILL BE IN SPACECRAFT TIME FOR THE EXECUTION 
OF SOME COMMAND OR FUNCTION. 

22 EVEN PARITY-GENERATED ON THE GROUND 


FIGURE 8-31 WORD FORMAT 
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1) Velocity - Low Thrust (VEL) - The fifteen bits of binary magnitude were 
equivalent to the desired velocity change in 0.1 foot-per-second incre- 
ments. The command caused thrust engine burning and integration of the 
resultant acceleration which was compared to the fifteen-bit constant. 
When equality -was achieved, the VEL command was terminated and the pro- 
gram advanced. In the stored program mode, the command was valid only 
when addressed by an internal EMP command. 

2) Pitch Plus (PIP) - The fifteen-bit binary magnitude was equivalent to 
l/l00th of a degree of angular movement about the pitch axis. Integra- 
tion-of-gyro rate was compared to the constant and equality terminated 
the command. In the real-time mode, the command was used directly and 
caused a plus rotation. In the stored-program mode, the command was 
valid only when addressed by an internal EMP or EMM command. 

3) Pitch Minus (PIM) - Same as PIP except for sign. 

4) Roll Plus (ROP) - Same as PIP except movement is about the roll axis. 

5) Roll Minus (ROM) - Same as ROP except for sign. 

6) Yaw Plus (Yap) - Same as PIP except movement was about yaw axis. 

7) Yaw Minus (YM) - Same as YAP except for sign. 

8) Discrete Commands (COM, CON, ACF, ACS, DHS, DAE, DEP, CAP) - The eight 
operation codes were combined with their respective fifteen-bit func- 
tion codes to produce up to 15 unique functional commands per operation 
code. The function commands were fifty-millisecond pulses to the re- 
quired spacecraft subsystem or to flip-flops for control of on-off com- 
mands. The total number of discrete commands provided was as follows: 


Profrrajnminp - Maximum efficiency of storage space was obtained by combining 
individual discrete functions into subroutines that were addressed from a 
master sequence and reusing as many subroutines as possible. Discrete com- 
mand words were formatted to provide a maximum number of independent sub- 
system functions that could occur simultaneously. A program flow diagram 
is shown in Figure 8-32. Each subroutine returned the program to a compare 
time which will control the time when the next event was executed. The 
mission profile command decision block was a series of jump commands which 
directed the program to the various subroutines. 

The programmer clock was implemented with a 20-bit word that was incremented 
every 0.1 second, and provided a 29.1-hour recycle period. The compare time 
(C0TJ command is only capable of equality comparison for a specific time 
within the recycle period. 


Photographic Subsystem 
Communication Subsystem 
Structure and Mechanical Subsystems 
Attitude Control 


23 Commands 
12 Commands 
9 Commands 
27 Commands 


163 



FIGURE 8-32: LUNAR ORBITER PROGRAMMING FLOW DIAGRAM 
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8.4.2 PRO GRAMMER REQUIREMENTS 

The programmer requirements evolved progressively with more detailed defini- 
tion of mission and subsystem requirements. As subsystem changes occurred, 
it was expected that the programmer could accommodate them. In this sense, 
there was no firm specification on the total requirements until after the 
critical design reviews of all subsystems and of the total spacecraft. The 
environmental requirements were the same as for other equipment on the 
equipment mounting deck. The reliability allocation was .949. 

The requirements for the programmer (as it was finally built) are listed 
below : 

1) Command Capability, Sequencing, and Priority 

The programmer shall decode, time, properly sequence, and execute the 
necessary stored program, real time commands, and signals to the 
following spacecraft subsystems: 

1. Attitude Control Subsystem 

2. Velocity Control Subsystem 

3. Reaction Control Subsystem 

4. Communications Subsystem 

5. Photographic Subsystem 

6. Switching Assembly 

7. Power Subsystem 

The programmer shall receive, condition, and utilize the necessary 
commands, power, and signals to accomplish the foregoing. Command 
execution sequence and reprogramming shall be as specified in the. 
spacecraft mission event sequence and time line analysis. Real time 
commands shall take priority over stored program commands. 

In addition, the programmer shall provide sufficient storage to con- 
trol the spacecraft for three (3) lunar orbits. 

2) Interrupt Capability 

The programmer shall provide the necessary circuitry to permit inter- 
rupting of the stored program under execution by a real time command, 
the execution of the real time command, and the restoration, if feasi- 
ble, of the stored program that was interrupted. 

3) Program Verification 

The programmer shall provide the capability to telemeter information 
from various programmer points such that basic program execution and 
operation of attitude control system can be monitored. 
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4) Time Reset Capability 

The programmer shall provide the capability to reset the spacecraft 
time to any value upon real time command. In addition, spacecraft 
time shall be reset-to zero by external hard line control. 

5) Time of Command Execution 

The programmer shall provide the capability of time dependent execution 
of commands to an accuracy of plus or minus (+) eight-tenths (0.8) of a 
second over an eight (8) hour time interval. The accuracy shall be 
based on the component's recording of time. 

6) Time Generation and Recording 

The programmer shall provide the capability of generating and recording 
time for a twenty-four (24) hour period with a resolution of one-tenth 
(O.l) of a second and a stability of one-tenth (O.l) of a second over 
an eight (8) hour interval. This capability to be repetitive with no 
loss in resolution or stability. 

7) Execute Attitude Maneuvers 

The programmer shall provide the capability at designated times of exe- 
cuting commanded three (3) axis attitude maneuvers and deriving space- 
craft position from angular rate information, either as a function of 
stored program commands or as a function of real time commands. In 
addition, the programmer shall provide for removing the spacecraft 
attitude control from control by spatial references and restoring the 
spacecraft attitude control to control by spatial references. 

8) Execute Velocity Maneuvers 

The programmer shall provide the capability at designated times of exe- 
cuting commanded velocity maneuvers and deriving spacecraft velocity 
from linear acceleration information either as a function of stored 
program commands or as a function of real time commands. 

9) Spatial Reference Acquisition 

The programmer shall provide the capability at designated times of exe- 
cuting commanded maneuvers and accepting pertinent information as to 
acquisition of spatial references, to acquire spatial references either 
as a function of stored program commands or as a function of real time 
commands . 

10) Computation 

The programmer shall provide the capability to add and compare numeri- 
cal (binary) magnitudes, to detect one (l) part out of eight hundred 
and sixty-four thousand (864,000), to integrate angular rate expressed 
as d.c. voltage, and to integrate linear acceleration expressed as the 
difference between two (2) pulse trains. 
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8.4.3 PROGRAMMER DEVELOPMENT AND OPERATION 

Design objectives were defined in the programmer functional requirements 
specification. It was anticipated that many hundreds of photographic 
sequences would have to be transmitted to the spacecraft and, therefore, it 
would be desirable to minimize the number of commands required to perform 
those sequences. This resulted in the decision to build a system which 
would require transmission of only the sequence variables. It was also 
recognized that all the functions required to be performed by the program- 
mer could not be established firmly and therefore a flexible design must 
be developed which could handle changes in producing command and command 
sequencing. Additionally, the flight programmer must have sufficient flexi- 
bility to be able to accommodate changes in the mission. Reliability was 
to be given high priority in both design and component selection. 

8. 4. 3.1 PROGRAMMER TRADE STUDIES 

Prior to actual hardware design, trade studies were pursued to establish 
the best design approach. The most important trades are described in the 
following paragraphs. 

One of the initial studies traded capability of executing only stored program 
commands in the progra mm er versus the execution of both real time and stored 
program commands. The trade study considered incorporation of real time 
decoding matrix circuitry in the command decoder subsystem, or incorporation 
of these same decoding functions in the programmer. Since the programmer 
had to provide essentially all of the same commands (in storage) to control 
the spacecraft, the same decoding circuitry could be used for both functions. 
This resulted in a reduction of total required hardware. 

A second trade study was conducted to establish whether the programmer should 
be made redundant or only single thread. The results of the trade study 
showed that the single thread system would meet the reliability requirements 
established for the programmer and that providing a second redundant system 
would be expensive in both weight and power. 

Improper execution within the programmer was given serious consideration 
since any malfunctions during critical operational periods would either be 
relatively catastrophic to the mission or would execute photographic 
sequences not previously planned. An even parity bit was included in the 
words stored in memory to prevent a single bit error from causing improper 
command execution. 

Early in the design phase a trade study was made to select the type of 
electronic circuitry to be used for the programmer. The trade involved the 
selection of integrated circuits versus discrete component circuits. In 
1964 integrated circuits were just beginning to be mass produced and there 
was a very definite question as to their reliability for use in the program. 
The trade study showed however, that the number of components, their size, 
weight, and volume which would be required to build the system with discrete 
components would be prohibitive. Therefore, the decision was made to use 
integrated circuits. This approach affected other subsystems within the 


167 


D2-1H277-2 


spacecraft. Since the programmer used integrated circuits the decision was 
made to use the same components for the command decoder and photographic 
subsystem digital circuits. 

Timing for the spacecraft was required to be controlled in l/lO of a second 
increments over a 16 hour period of operation. This required a crystal 
oscillator frequency stability of one part in 10^. Since the clock was 
vital to spacecraft control and there was some question as to the reliability 
of the oscillator, the decision was made to use two of them, each with its 
own countdown chain, with the provision to switch between them in case of 
failure. 

A trade study was conducted in the initial design of the programmer to deter- 
mine if information transferred within the programmer should be accomplished 
in a serial manner or in a parallel manner. Since power, weight and volume 
were critical parameters for the design of the spacecraft, it was evident 
that a minimum number of integrated circuits should be utilized in the design 
of the computer. Serial operation was selected because it did provide a 
minimal number of circuits. The selection of serial operation for the pro- 
grammer required the magnetic core memory output information be transferred 
serially to the rest of the programmer circuits. 

The size of the magnetic core memory was dictated by the number of command 
words required to be stored for 16 hours of mission operation. From study 
of the mission profile and the photographic sequences and maneuvers required, 
it was immediately evident that the development of a standard program where 
all command words are stored independently for each of the maneuver sequences 
would cause the number of words required by the programmer to approach 512 
words. Since a memory of this size exceeded the initial estimate, it was 
apparent that some method must be incorporated in the programmer design to 
reduce the amount of magnetic core memory. The most obvious solution was 
to make the programmer execute repetitive sequences wherever possible in 
the mission programming. It was estimated that approximately 30 command 
words would be required to execute a single photographic sequence. Within 
this sequence however, only 8 words were required to be modified to accom- 
plish a second sequence. By developing special instructions it was possible 
to program 7 photographic sequences (16 hours of operation) using only 120 
wcrds of memory. From this information the magnetic core memory for the 
flight programmer was determined to be 128 words. 

The programmer was required to command and fire all spacecraft pyrotechnic 
devices. A trade study was conducted to determine where to put the firing 
circuits and what kind of circuit configuration should be used. Since the 
pyrotechnic circuits were required to supply 5 amperes to the pyrotechnic 
bridge wires, it was decided that these circuits should be separated from 
the flight programmer in order to eliminate any RFI problems. These pyro- 
technic circuits were then put in a separate unit called the switching 
assembly and physically displaced from the vicinity of the programmer 
electronics. 
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8 . 4- 3 • 2 Switching Assembly 

The block diagram of the switching assembly is shown in Figure 8-33. Low- 
level signals from the programmer were converted in the switching assembly 
to high-current (5-10 amperes) or voltage level (28 volt) signals. The 
switching assembly weighed 6.3 lb and used 2.5 watts power continuously in 
addition to the short current pulses for the discretes. The arming switches 
were closed by umbilical command and their actuation monitored prior to 
launch. The inhibit switches provided further protection against inadvertent 
firing of the squibs. The squib drivers were directly connected to the squib 
bridgewires. This assembly provided isolation of large signal- transient and 
electro-magnetic fields from other equipment. 

8. 4. 3. 3 Programmer Testing 

Upon completion of fabrication, the programmer units were subjected to a 
series of tests to demonstrate that the units complied with all specified 
design requirements. The three classifications of test at the unit level 
were (l) the Flight Acceptance Tests, (2) a Qualification Test, and (3) a 
Reliability Demonstration Test. The units were also required to pass similar 
Spacecraft Level Test Requirements. 

The System Design Verification tests provided important operation and perfor- 
mance information about the programmer when combined into the operating sub- 
systems. One of the most important of these tests was the Attitude Control 
Subsystem test on the Air Bearing Simulator. The inability to execute stored 
programs and the resulting changes are discussed in Section 3.0. 

One major problem area and two major potential problem areas were discovered 
during component testing. The first potential problem area was noted during 
the vacuum thermal portion of the flight acceptance test on the first pro- 
grammer unit. During this portion of the test, what was considered an exces- 
sive number of failed components and solder connections were noted. As this 
unit had passed the pre-functional test without detection of these defects, 
temperature tests were initiated at the board and module level to detect and 
correct these defects befbre final unit assembly. The second potential pro- 
blem area was discovered later in the testing program. It was found that 
the static discharge from personnel wearing nylon garments when handling 
micrologic components was sufficient to cause component failure. This pro- 
blem was alleviated by requiring all nylon garments to be replaced by cotton 
garments, and that all personnel "ground" themselves before handling any 
components . 

The one major problem that was detected during testing was a micrologic 
module contamination problem. The problem was associated with a certain 
lot of modules. One hundred and thirty-four of 214 modules that were re- 
ceived from that particular lot indicated evidence of contamination. The 
contamination appeared as a brown or black amorphous material on the outside 
of the micrologic case surrounding the external gold plated leads at the 
case lead interface. The contaminant was conductive and when spread from 
lead to lead resulted in a short circuit. The contaminant was metallic 
lead which resulted from a module sealing procedure by the manufacturer. 

The problem was corrected by replacing all modules that were received from 
that particular lot. 
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Of the failure reports made with respect to the programmer during testing 
approximately 39# of these reports were attributed to design, fabrication 
and workmanship deficiencies; 44# were attributed to test procedure, test 
equipment, and test personnel errors. The remaining 17# were attributed to 
part failures and. causes listed as unknown. The above figures do not in- 
clude part failures detected at module and board level tests. 

8. 4*3.4 Programmer Mission Performance 

Performance of the programmer and switching assembly was satisfactory on 
flights. For convenience, the pertinent data is summarized in Figure 
8-34. There were no known hardware failures. There were instances of 
anomalous spacecraft operation that occurred. The unexpected or unusual 
events are discussed in the brief in the following: 

Mission I - Primary Mission Phase 

Command activity, although planned in minute detail before the start of the 
mission had to be completely revised. This resulted in occasional frantic 
command activity due to late definition of modified mission parameters and 
late parameter changes. However, all mission requirements were met, with 
only two wrong commands being transmitted to the spacecraft. 

Mission I - Extended Mission Phase 

During the extended mission activities, performance of the programmer was 
nominal, with the exception of a low voltage condition encountered on day 
288 of 1966. This condition resulted from a series of improper maneuver 
commands being transmitted to the programmer and was discussed in section 
7.0. The battery voltage of the spacecraft was insufficient to maintain 
the proper logic levels on the programmer. This resulted in improper opera- 
tion. It should be pointed out, however, that the programmer was operating 
correctly with a spacecraft bus voltage of only 17 volts. The minimum volt- 
age design requirements was 21 volts. The programmer was also subjected to 
temperatures in excess of the design or test requirements with no malfunc- 
tions. 

Mission II 


This was the longest of the five missions yet had the least amount of diffi- 
culty with the programmer. Although both temperature and voltage limits 
beyond the programmer design requirements occurred, there were no anomalies. 

Mission III - Primary Mission Phase 

During Mission III a programming error resulted in failure to generate a 
photo activation time code for the photos of site III P-1. This error re- 
sulted from a deviation from the planned photo command sequence and misinter- 
pretation of programmer operation by the command programmer analyst. The 
deviation from the planned command sequence was to accommodate a real time 
command to change camera shutter speed. 
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I 

II 

III 

IV 

V 

LAUNCH DATE 

8/10/66 

11/6/66 

2/5/67 

5/4/67 

8/1/67 

LUNAR ORBIT TRAJECTORY DATE 

8/14/66 

1 1/10/66 

2/8/67 

5/8/67 

8/5/67 

TERMINAL DATE 

10/29/66 

10/1 1/67 

10/9/67 

7/17/67 

101-167* 

1/31/68 

DAYS OF OPERATION, DAYS/HOURS 

80/1920 

338/8112 

247/5928 

97/2328 

192/3608 

DISPOSITION 

Lunar 

Surface 

Lunar 

Surface 

Lunar 

Surface 

Lunar 

Surface 

Lunar 

Surface 

PRIMARY MISSION LENGTH, DAYS 

35 

30 

32 

28 

26 

. REAL TIME COMMANDS 
TRANSMITTED 

1,988 

1,289 

1,266 

3,666 

1,703 

. STORED PROGRAM COMMANDS 
TRANSMITTED 

2,522 

2,282 

2,349 

3,445 

2,822 

. COMMANDS EXECUTED 

15,000 

12,000 

15,000 

20,000 

14,000 

. ORBITAL PERIODS, HRS/MIN 

3h-26m 

3h-28m 

3h-28m 

12h-lm 

3h-llm 

. CLOCK DRIFT (SECONDS) 

+1.6 

-1.2 

-0.16 

-0.96 

+0.66 

. NUMBER OF PICTURES (WIDE 
ANGLE AND TELEPHOTO) 

422 

417 

327 

359 

425 

NUMBER OF VELOCITY MANEUVERS 

5 

7 

7 

4 

6 

NUMBER OF LUNAR ORBITS 

547 

2325 

1702 

225 

956 


TOTAL SPACE OPERATION TIME OF PROGRAMMER NO FAILURES - 954 DAY/22,896 HOURS 
PREDICTED UNIT RELIABILITY (MTBF ) _ 13,900 HOURS 


*L.O IV DISAPPEARED ON 7-17-67, ORBIT DECAY TO CRASH ON SURFACE PREDICTED FOR OCT. 1967 


FIGURE 8-34 SUMMARY OF LUNAR ORBITER PROGRAMMER PERFORMANCE 
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Mission III - Extended Minion Phase 

During the extended mission phase, it appeared that the flight programmer 
unit was malfunctioning. On several occasions memory storage locations 
were found to be- altered and improper command sequences to have been exe- 
cuted. It was determined that commands transmitted to other spacecraft 
concurrently in Lunar orbit were accepted as valid commands by the Mission 
III spacecraft receiver and were issued to the flight programmer either for 
storage or execution. Although each spacecraft had a separate address code, 
it was not adequate under conditions of weak signal strength, to exclude 
extraneous bits being received. The problem was alleviated by controlling 
transmission times with respect to spacecraft orbit locations. Also the 
radio frequency of the spacecraft being commanded was pulled away from the 
other spacecraft receiver frequency by the DSIF uplink while in lock with 
the spacecraft receivers. 

Mission IV - Primary Mission Phase 

Subsystem anomalies during the mission resulted in numerous non-standard 
command sequences being transmitted to the spacecraft. As a result of this 
increased command activity, three programming errors were made. The first 
error was due to the failure to update a modifiable command. This caused 
initiation of a wrong command sequence. The second error was the premature 
termination of a maneuver by the inadvertent execution of a real time com- 
mand that was being held in the command decoder. The third error resulted 
in the late initiation of a command sequence and was caused by misinterpre- 
tation of a command sequence by the programmers. None of these errors pro- 
duced serious, irrevocable conditions. 

Mission V 


Command activity was considerably reduced and improved during mission V with 
respect to earlier missions. This was due in part to further improvements 
in the information flow to the programmer analysts by the other mission per- 
sonnel and the earlier acquisition of required mission data that was neces- 
sary for incorporation into the command sequences. 

8.4«4 Programmer Conclusions and Recommendations 

The programmer provided satisfactory control and sequencing of spacecraft 
events throughout all missions . In addition to satisfying all design re- 
quirements, it provided the flexibility to accommodate both mission anom- 
alies and changes in mission objectives. Based on the experience with the 
Lunar Orbiter programmer, the following conclusions are made: 

l) The selection of a simple, straightforward, single thread design with 
limited redundancy (redundant oscillators and countdown chain) resulted 
in a unit that was reliable and easy to operate. The reliability demon- 
strated by the units exceeded the reliability allocations of the design 
requirement. Being straightforward and easy to operate was of particu- 
lar value to both the test program and to mission operations personnel. 
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2) The selection of special instructions and the use of subroutines were 
effective in minimizing the amount of memory required to accomplish 
any specific mission task. 

3) Possible deleterious effects of EMI to the low level logic circuitry 
was avoided by the decision to place all high current or voltage 
switching circuits (such as squib and engine valve drivers) in a 
physically separate unit (the switching assembly). 

Recommendations for "doing differently if one had it to do over" are: 

1) Verification of programmer storage was difficult. It required one 
ground transmitted command for each word telemetered. Provision should 
have been made to allow block transfer of the entire magnetic core 
memory 'to verify the information stored there. This would have aided 
test significantly. The decision on the program not to incorporate 
this capability was made on the basis of minimizing parts count for 
reliability purposes. 

2) The programmer was implemented with a half adder. A full adder should 
be implemented to allow for incrementing and decrementing of time and 
magnitude values for greater flexibility in command execution. Here 
again the decision against such inclusion was based strictly on parts 
count or reliability. Significant operational flexibility would have 
been gained by such an adder. Work-around methods on programming 
would have been simplified thus reducing the load on operations per- 
sonnel. 

3) The storage capacity of the programmer was only 128 words. As such 
the unit had to be remapped periodically throughout the missions 
placing heavy reliance on the data link. A greater storage capacity 
would have reduced the continuous mapping and search for storage 
locations during missions operations. 

4 ) Programming of the system would have been easier if the "modified jump" 
command had been limited to a specific number of executions. This 
would have allowed more flexibility in the transfer between subroutines 
and also reducing the load on ground operations personnel. 

5) Provide for a more general purpose instruction set to permit greater 
flexibility in recursive programming to minimize storage space. It 
would allow maximum use of programming techniques to minimize pro- 
gramming loads and coding errors. 

6) Maneuver commands were executed through a comparison of accumulated 
magnitude and the commanded magnitude. A timed backup should be pro- 
vided in case of breakdown of the comparison process. 

7) The programmer was implemented at the time of development with state- 
of-the-art hardware. However, with the advance in technology, consi- 
deration should be given to newer low power devices which could reduce 
power requirements by a factor of 4» 
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8) Cordwood module interface circuits should be replaced with integrated 

circuits . 

8.4.5 CLOSED LOOP ELECTRONICS DESCRIPTION 

The Closed Loop Electronics (CLE) was located in the Flight Electronics Control 
Assembly. Functionally the unit was a part of the Attitude Control subsystem 
discussed in Section 3.0. The CLE circuit schematic is shown in Figure 8-35. 
The unit was basically all analog in operation but provided digital (ON-OFF) 
type control signals to the reaction control jets. 

Specifically the CLE performed functions of amplifying, shaping and discrimina- 
ting signals from the inertial reference unit, celestial sensors, and the 
flight programmer. It accepted signals in all three axes from the IRU rate 
or rate integrate modes. The unit also connected and disconnected celestial 
reference sensors upon command from the programmer. 

The closed loop electronics circuits were designed around the power supplied 
by the programmer, which was + 15.0 VDC, + 6.0 VDC and + 28.0 VDC. The unit 
consisted of 72 solid state circuits of 23 configurations. 

8 . 4.6 CLE REQUIREMENTS 

The CLE was required to accomplish two primary tasks. 

1) The CLE shall provide for the control of three axis attitude 
control thrusters as a function of spatial reference signals, 
spacecraft dynamics, and inertial sensors. In addition, the 
CLE shall provide for the control of attitude control thrusters 
as a function of attitude commands, angular rate, and space- 
craft dynamics. 

2) The CLE shall provide analog displacement error signals to the 
pitch and yaw thrust vector control actuators as a function of 
inertial reference position signals and spacecraft dynamics. 

These tasks were satisfied by performing the following functions. 

1) Close rate and attitude control loops with inputs from inertial 
reference unit, sun sensors, and star tracker. 

2) Provide lead/lag compensation on inertial reference unit attitude 
signals for reaction control and thrust vector control. 

3) Amplify and limit sun sensor outputs. 

4) Accept mode switch commands from the programmer. 

5) Provide valve drivers for plus and minus thrusters in three axes. 

6) Provide "one-shot" to thrusters for minimum impulse bit operation. 
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8.4.7 CLOSED LOOP ELECTRONICS DEVELOPMENT AND OPERATION 

The detailed circuit parameters of the Closed Loop Electronics were dictated 
by the functional interface requirements of the chosen Inertial Reference Unit 
and the reaction control- system. As such the alternatives available to the 
designer were relatively limited. The circuit techniques, being linear, were 
straight-forward and had a proven history of past usage for this type of 
applications. The most critical problems were: l) achieving high reliability 

circuits through worst— case design methods, 2) the selection of components 
that would enhance operational integrity, and 3) the minimization of the 
power dissipation of the unit. 

A primary consideration in the design of the CLE was to keep the power level 
as low as possible. This meant the circuits were to be designed with 
performance characteristics secondary to power constraints. This objective 
was met with a final power dissipation figure of 0.44 watts in normal opera- 
ting mode and 25.5 watts with everything turned "on" including four thrusters. 
This was considerably less than was possible to attain with commercially 
available operational amplifiers. This saving was accomplished by optimizing 
each circuit to the task performed, and by judicially keeping power driving 
stages of the circuits in the "off" state during quiescent conditions. The 
performance capability of the sun sensor operational amplifier, which is 
typical of many CLE circuits, is shown in Figure 8-36. 

8. 4. 7.1 DESIGN EVOLUTION 

The evolution of the closed loop electronic unit from a set of general require- 
ments to the final flight article was one of continuous design iteration. 
Starting with a set of preliminary input and output interface characteristics, 
representative circuits were synthesized and breadboarded . The prototype 
breadboards were then tested under worst case conditions in voltage variations 
and temperature extremes. As detail requirements evolved and became more 
definitive, the breadboards were modified and retested to more stringent 
design parameters and tolerances. The development of the CLE did not en- 
counter any major problems. The most significant design events are discussed 
in the following paragraphs. 

Th'a unit originally required zero crossing detection circuits that acted on 
gyro position outputs and celestial sensor outputs with the objective to reduce 
the limit cycle deadband contribution to maneuver error. These circuits were 
deleted prior to the critical design review after analysis indicated the gain 
derived did not offset the penalties incurred in design complexity. In the 
design of signal switches, an investigation was conducted on the advisability 
of solid state switches versus relays. Relays were rejected for reliability 
considerations. The choice was for solid-state switches with "Field Effect 
Transistor" output stages. 

Though not a major problem, difficulties were encountered in how best to 
determine the "aliveness" of the closed loop electronic unit when mated to 
the IRU, celestial sensors, and the reaction control system. Test points 
were added, along with signal conditioning circuits for telemetry monitoring 
functions, to permit operational checks. The objective was to be able to 
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CIRCUITS 

REQUIREMENTS 

PERFORMANCE 

Operational Amplifier - (Sun Sensor) 



Voltage Gain - (Closed Loop DC) 

104.8 V/V + 2% 

104.8 V/V + 2% 

Input Impedence - (Closed Loop) 

Equal to 

Series Sensing Resistor 

Output Impedence 

50 fi 

ion 

Frequency Response - 3 dB (Closed Loop) 

10 Hz 

100 Hz 

Output Limits 

+5.0 min. 

+ 5.0 V 

Temperature Drift 

2.5^tV/°C 

1.0yUV/°C 

Supply Voltage 

+ 15 V + 1% 

+ 15 V + 1% 

Supply Ripple & Noise ATTEN 

20 dB 

34 dB 

Eq. Input Noise 

10 M V RMS 

5 M V RMS 

Maximum Load Allowable 

2.8 K 

2.0 K 

Voltage Gain - Open Loop 

74 dB min. 

86 dB 

Power Dissipation 

200 MW 

20 MW 

Undistorted Output Range 

+ 4.5 V min. 

+ 5.0 V 


TABLE 8-36 - OPERATIONAL AMPLIFIER CHARACTERISTICS 
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isolate a failed unit to the black box replacement level. In this sense 
the check points provided were adequate. 

Protection of the reaction control thruster driver amplifiers required that 
coil induction voltage suppression be provided to limit the voltage spike 
which appeared across the output stage of the amplifier when the coil of the 
solenoid was turned off. Any voltage limiting placed across the coil 
increased the drop out time of the valves and thereby increased the minimum 
pulse of the jets. The original circuitry designed to limit the voltage 
spike performed the function adequately, but was subsequently modified when 
more realistic information on the 0.05 lb. thruster solenoid and drop-out 
time requirements became available. Tests to optimize the valve off delay 
showed that the inductive kickback suppression diode voltage must be in- 
creased to about 22 volts (see Section 4*0 for details). The power rating 
of the diodes was also increased to withstand higher power surges. The 
actual change effected put two of the diodes previously selected in series 
because they were on the approved part list and available from stock. 

The spacecraft design and analysis progressed in parallel. This required 
that some provisions be made to allow selection of electronic part values 
quite late in the design cycle. The latest planned change which occurred 
was the thrust vector control compensation networks. Resistor and capacitor 
values were finally firmed up after the simulated closed loop thrust vector 
control subsystem test conducted in the fall of 1965. Again, the precise 
values used were selected on the basis of approved available parts which 
differed only slightly from those desired. 

8. 4. 7. 2 RELIABILITY 

Reliability of the closed loop electronics unit was achieved through worst- 
case design techniques, failure mode effect and criticality analysis, and 
through careful selection and screening of components. Each CLE circuit was 
breadboard ed and subjected to functional operation checks, including evaluation 
at temperature extremes of -30° C to +70° C prior to final packaging. Modules 
that failed under functional tests were dissected and analyzed to determine 
the failure modes. The information was fed back to the production people to 
prevent future problems. 

Heavy emphasis was placed on component selection and part derating. 86 per- 
cent of the resistors were stressed at only one percent of the rated power and 
only two resistors were employed at 20 percent of rated power. All transistors, 
except for six, were used at less than one percent of rated power. The six 
were used at 20 percent of rated power, and subjected to no instantaneous 
voltages higher than 50 percent of rated voltage. All diodes were used at less 
than one percent, except for 12 that were used at 15 percent of rated power. 

Of the capacitors, 12 were used at less than 45 percent of rated voltage, 15 
were used at less than 35 percent, 20 were used at less than 15 percent and the 
remaining 16 capacitors were used at less than three percent of rated voltage. 

The final closed loop electronics configuration had a predicted failure rate 
of 2.745 x 10-6. 
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8. 4- 7. 3 PACKAGING AND MANUFACTURING 

The closed loop electronic circuits were discrete component transistor- 
resistor circuits and were packaged in welded cordwood module configurations. 

The individual modules were soldered to CLE module mother boards which are plug- 
in type and are completely replaceable and interchangeable. Conceptually 
this technique is relatively straight-forward and permits the greatest packing 
density for an allocated volume. However, because of this need for high 
density, electrical and fabrication problems were encountered. Some circuit 
layouts were found to be susceptible to cross-talk interference between the 
input and output signal paths resulting in circuit oscillations. This problem 
was eliminated by modifying layout of sensitive components. Fabrication 
difficulties were the result of Immaturity of manufacturing processes. The 
majority of failed modules resulted from poor workmanship or careless handling 
of parts, i.e., poor or broken welds, use of components with erroneous values, 
overstress components, etc. Manufacturing also encountered many unforeseen 
problems in implementing the electro-deposited solder process for cordwood 
modules and was finally required to switch to the use of a conventional KPR- 
resist type of etched card coated with electrolysis tin in order to meet the 
schedule. A corollary to this problem was the procurement of parts under 
Minuteman specification with tinned leads which were not compatible with L. 0. 
manufacturing processes. This required rework of leads prior to use. 

Modules which tested satisfactory prior to application of potting compounds, 
failed tests following potting. The potting processes and compounds employed 
stressed the components and caused geometrical changes, throwing the potted 
modules out of specified electrical tolerances. Damage to module header 
pins was also experienced as a result of poor potting process specifications. 
This was alleviated by using soft silicone rubber plugs around the header 
pins entering into the molds allowing seepage of materials and easy removal 
of plugs. 

8.4. 7.4 MISSION PERFORMANCE 

The Closed Loop Electronics performed satisfactorily on all five missions. 

There were only two indications of off nominal or out of tolerance operation. 
During the extended mission phase of L.O. IV the plus pitch jet one-shot 
appeared to be malfunctioning. The telemetry indication from which this was 
deduced was a continuous pitch jet "on" signal with no accompanying change of 
pitch rate or position from the edge of the deadband. 


The second out of tolerance condition occurred during the extended mission of 
L.O. V. It appeared that the minus pitch threshold detector was triggering 
at -1.1 volts instead of -2.0 volts. This shifted the deadband on one side. 
The effect was evident in maneuver rate, especially in wide deadband, and in 
limit cycle operation. 

The wide deadband pitch minus maneuver rate was -.26 degrees/second instead of 
-.05 degrees/second. It was estimated that this caused the use of an extra 
.25 pounds of N 2 gas over a 126 day period. The limit cycle deadband was 
similarly reduced on the plus pitch side by approximately 50 percent in both 
wide and narrow deadzone. Since neither of these anomalies jeopardized the 
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primary mission objective and had negligible effect on the extended mission 
there was no failure investigation made. 

8.4.8 CLOSED LOOP ELECTRONICS CONCLUSIONS AND RECOMMENDATIONS 

The major conclusions of this study of the Closed Loop Electronics are: 

1) The things which contributed most to the success of the CLE design 
were: 

(a) Use of worst case design methods. 

(b) Selection of parts to enhance reliability, e.g., no part was 
used at greater than 50 percent of rated voltage; most were 
used at one percent of rated power. 

(c) Extensive engineering development testing of breadboard circuits 
and prototype assemblies as the design progressed, including 
evaluation at extremes of temperature of -30 degrees C and 

+70 degrees C. 

(d) Use of proven well understood circuits. 

2) The ability to make changes late in the design cycle was an important 
asset of the design, e.g., the final values of the TVC compensation 
networks were dependent on total spacecraft dynamics and not available 
until late 1965. 

3) The use of welded cordwood modules enhanced the circuit integrity 
once the process was completed satisfactorily. 

4 ) The thermal design was more than adequate for the power to be 
dissipated. 

5) Manufacturing processes introduced difficult problems to solve, 
e.g., the potting of modules; the tinned leads on components were 
not compatible with welding. 

Recommendations for doing differently if one had it to do over are: 

1) Parts procurement specifications and selection should be checked 
for compatibility and availability before releasing actual 
fabrication orders. 

2) The output channels of the CLE should have been tested at the compo- 
nent level with the expected impedance of the interfacing component, 
e.g., the TVC actuator jitter problems when first tested on the 
spacecraft. 

3) Many of the operational amplifiers and other analog circuits could 
now be replaced by integrated circuits if weight and power limita- 
tions demanded. 
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8.5 THRUST VECTOR ACTUATOR 

The thrust vector actuator was a new component which was developed to the 
specific performance, environment, and envelope requirements of the Lunar 
Orbiter. The actuator was one component of the thrust vector control sub- 
system described in Section 5.0. The function of the actuator was to 
position the gimbaled engine in response to error signals from the gyros and 
closed loop electronics. 

8.5.1 ACTUATOR DESCRIPTION 

The actuator was an electromechanical position servo and is illustrated in 
Figure 8-37. It was sealed and pressurized with nitrogen gas to 7 psia to 
prevent problems with bearings and motor brush operation in the space vacuum 
environment. The value of 7 psia was chosen so that the pressure differential 
effects would be approximately equal for sea level testing as for vacuum 
operation. The output shaft was an acme threaded jacks crew which was sealed 
by an accordian type metal bellows. The actuator position was maintained at 
each end burn position by switching off the 28 volt power to the actuator at 
the conclusion of each velocity maneuver. 

8.5.2 DESIGN REQUIREMENTS 

Specific requirements imposed on the actuator are listed in Figure 8-38. 

These were determined by the demands of the thrust vector control sub- 
system of which the actuator is a part. 

A position actuator rather than a rate actuator was specified because it 
simplified other portions of the TVC subsystem, and because precision 
position feedback was easier to implement. 

In order to maintain thrust alignment with the c.m. , a requirement for 
irreversibility was set. During the motor operation, the actuator was in a 
controlled mode and engine vibration did not affect the actuator motion. 
Between burns in a space environment the load on the actuator was small and 
the required friction torque for irreversability was small. The worst load 
environment was due to vibration during the boost phase and this determined 
the friction level for irreversability. Following final design it was deter- 
mined that the actuator would not be irreversable under the maximum (3 O ) 
boost vibration environment and the actuator was allowed to move at a rate 
not to exceed .05 inch per second. An operation procedure was developed 
which recentered the actuator to its electrical null after boost and prior 
to first motor ignition to circumvent this problem. As it turned out, the 
actuator never moved off null during boost on any of the five flights and the 
recentering was not necessary. Due to the implementation of the thrust vector 
system in which a position actuator was employed, spacecraft center of mass 
offset is a significant error source. In order to reduce this error, it was 
necessary to provide for mechanical length adjustment on the actuator to 
align the thrust vector through the measured c.m. with the actuator at its 
electric signal null. Mechanical adjustment capability of +0.25 to -0.15 
inches (2.4 degrees to -1.46 degrees of nozzle) was provided. The stroke 
limit was determined by calculation of the maximum travel required by the 
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Figure 8-37: THRUST VECTOR CONTROL ACTUATOR 
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REQUIREMENT 

1. Position Actuator 1. 

2. Irreversible 2. 


3. Mechanical Length Adjustment 3. 

about nominal of 8,5 inches 


4. Performance : 4. 

Stroke +2.8 degrees 
Rate = 10 deg/sec 
Resolution - + 0,018” 

(0.18 degrees) 

Natural Frequency = 2.5 CPS 
Load = 3.0 lbs. including: 

- Gimbal Bearing Load 

- Thrust Offset 

- Engine Hose 

- Heat Shield ' ^ 

Inertia Load = 0.05 Slug fx 

(6 inch arm) 


5. Solid' state servo electronics 5. 

were included in actuator. 

Nominal scale factor = 1 volt/ 
degree + 5 percent. 

6. The nominal thermal environment 6. 
was 60°F + 25°. In addition a 
thermal soakback - 175°F at rod 


and for one hour after engine 
bum. 

7. At least 18 day life. 7. 

8. Weight was 3.55 lb. Original 8. 

objective was 2.2 lb. 

9. Power - 3.2 Amps maximum peak 9. 

from 28 volt nominal source, 

0.55 Amps nominal steady state. 

10. Hermetically sealed with dry 10. 

N 2 gas with Helium trace. 


EXPLANATION 

Predictable initial position of null 
and easy to check out and monitor. 

Maintain engine pre launch alignment 
through C.M. during boost. Minimize 
start transients by retaining engine . 
position established during a pre- 
ceding burn. 

Permit pre launch adjustment to align 
engine through spacecraft center of 
mass with the actuator at electrical 
null. 

To provide required system performance 
with at least 6 db gain margin from 
startburn to endburn conditions 
including effect of: 

a. Solar panel and antenna flexibility 

b. Shortburn requirement with: 

- Actuator hardover position 

- Maximum C.M. offset 

- Reaction control recovery 
capability without spacecraft 
attitude over shoot exceeding 
gyro gimbal limits 

c. Maintain thrusting vector direction 
within + .4° (3 a ) of initial 
attitude . 

The actuator performance as specified 
is a very intimate interface between 
mechanical and electronic design. 
Minimum development time was a factor. 

An added thermal constraint was 
required on the actuator due to heat 
soakback from the engine subsequent 
to engine burn. 

Last planned engine burn was to obtain 
photo orbit within 18 days of launch. 

Weight budget. 

Power budget; also internal heating. 


'To withstand space environment, Helium 
trace for leak detection purposes. 


FIGURE 8-38 THRUST VECTOR ACTUATOR DESIGN REQUIREMENTS 
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actuator to align the thrust with the center of mass plus adding an addi- 
tional 1.5 degrees of nozzle deflection for control purposes. The addi- 
tional 1.5 degrees was determined on an analog computer to give adequate 
control acceleration for system response. 

The actuator frequency response limit was specified to be greater than the 
expected structural frequency. Due to the nonlinear response of the actuator 
caused by rate and acceleration limiting, the frequency response was defined 
for two amplitudes. The frequency response requirement is shown in Figure 
8-39. The high amplitude response requirement has a lower frequency roll off 
due to rate and acceleration saturation. 

The rate requirement (10 degrees/second) was set high enough to assure 
adequate dynamic stability margins with an engine initial misalignment with 
the c.m. of 3.8 degrees and stroke limits of +2.8 degrees. The rate require- 
ment was based on analog computer simulation results. 

8.5.3 DEVELOPMENT AND OPERATION 

A significant factor in the development of the actuator was the extremely 
compressed time scale available for development and qualification. Procure- 
ment specifications for the actuator were released early in September, 1964, 
following the decision to use the gimbaled engine. This was more than five 
months after contract go-ahead. Only 3 l/2 months were allowed to deliver 
the first engineering test model. The first qualified flight unit was 
scheduled for delivery in eight months. 

8 . 5 • 3 . 1 VENDOR SELECTION 

There were three vendor replies to the actuator request for proposal. Two of 
them were similar to the c hosen design. The third was a stepper motor concept. 
The stepper motor concept was discarded because it was felt that a stepper 
motor was unproven for this application. 

Between the other two vendors one had neglected the effect of the hermetic 
seal on the actuator load. The load on the output due to pressurization was 
actually larger than any of the loads listed in the specification. The pro- 
posed design from Kearfott Inc. was selected. The actuator vendor had three 
months from go ahead to delivery of the first engineering development unit. 
During this time period a vendor preliminary design review and critical design 
review were held. Partly due to this extremely tight schedule and partly due 
to poor quality control on the actuator manufacture, several significant 
problems were uncovered during the test programs at Boeing. 

8. 5.3.2 DEVELOPMENT PROBLEMS 

A summary of problems encountered during the developmental and early system 
integration testing phase and the rework or redesign required to cure the 
problems is shown in Figure 8-40. The first major problem was the failure of 
the actuator to meet the required rate limit under all design conditions 
which included design loads, low input voltage, and external pressure. In 
order to cure this problem more careful assembly and testing of the jacks crew 


186 



(PEAK AMPLITU DE/PEAK AMPLITUDE AT 0.10 CPS) 


D2-1 14277-2 


FREQUENCY RESPONSE REQUIREMENT 
Resolution .018 Inch 



NOTES: 

1 . Under Design Load of ± 18 inch Lb. 

2. Frequency Response about 
the Actuator Null 

3. Linear Resolution - .018 inch 


FIGURE 8-39 THRUST VECTOR ACTUATOR FREQUENCY RESPONSE REQUIREMENT 
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PROBLEM 


CAUSED BY 


REMEDY 


-c 


1. Power transistor failure 1. 

in development actuator. 


2. Low actuator rate 2. 


3. Actuator motion during 3. 

vibration 

4. Erratic actuator operation 4. 

and high electrical power 

usage . 


5. One actuator leaked, 5, 


Design of Darlington switching 1, 

circuit electronics without due 
regard to inductive nature of 
load or back EMF of motor, 

o Excessive actuator friction, 2, 

o Low motor torque 
o Increase in design load 


Insufficient reverse impedance 3. 


o Electro-magnetic interference 4. 
sensitivity 

o Coupling of actuator and 
control electronics • 


Porous casting. 5. 


Larger transistors incorporated. 


o Improve mechanical assembly pro- 
cedures with maximum load tolerance, 

o Pre-assembly motor run-in with 
minimum torque tolerance. 

o Increase motor output. 

o Increased motion tolerance 

o Center actuator prior to first burn 
during flight operation. 

o Modify actuator control electronics. 

o Provide filtering to decouple system. 

o Separate command and power ground 
circuits. 

o Increase actuator deadband (increase 
resolution tolerances). 

o Added loading resistor to C.L.E. 

Rejected part, one time occurence. 


FIGURE 8-40 THRUST VECTOR CONTROL DEVELOPMENT PROBLEMS 
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assembly was required. Later the motor size was increased to achieve the 
minimum required torque at low voltage. The electronics were changed, 
including larger motor drive transistors, to reduce voltage drops to the 
motor in order to increase the motor voltage for higher power output. One 
significant result of the low rate problem was a requirement to "run in", 
i.e., operate, the motor prior to actuator assembly. The motor "run in" 
was required to achieve a predictable and dependable power output for a 
specific power input. Motor power output and jackscrew assembly torque 
were measured prior to assembly to insure that required rates would be met 
following assembly. 

Erratic operation and high power consumption due to internally and externally 
generated noise were a severe problem. Several modifications were required 
to solve this problem. Filtering was done in the compensating or drive 
electronics to reduce command signal noise. Filtering in the actuator was 
also done. 

Larger motor drive transistors were used so that the higher peak power 
transient levels could be tolerated in these transistors without failure. 

A deadband built into the actuator electronics before power was applied to 
the motor was increased to lower the susceptibility to noise. Increasing 
of the deadbands reduced the resolution capability of the actuator. It 
was determined on the analog simulation that the wider resolution tolerance 
was acceptable. 

During the first thrust vector subsystem level testing on the spacecraft, 
severe coupling was discovered between the closed loop electronics and the 
actuator. The problem was a result of a poor impedance match between these 
two components. In order to rectify the problem, a load resistor was added 
across the output of the closed loop electronics. 


Actuators were delivered to Boeing unpainted so that the solder sealed case 
could be visually inspected. CAT-A-LAC black paint was applied prior to 
spacecraft installation but after passing incoming inspection. A helium 
leak detector was used to check for leakage. 

Following the above modifications to the original design, there were no 
significant failures during the environmental, reliability demonstration 
testing or qualification testing. There were no failures or performance 
degradation on the 10 flight units. Temperature rise during operation of 
the actuator was not a problem because the thermal mass was great enough 
to withstand .all the power that the motor could take. 

8. 5. 3- 3 MISSION PERFORMANCE 

Performance of the actuators was satisfactory during all missions. Oper- 
ational life of the actuators is shown in Section 5.0. The operational 
flight time for the actuators was short because the actuator was operated 
only during the velocity maneuvers. Of significant importance is the fact 
that two of the thrust vector actuators on spacecraft L.O. II operated 
without detectable performance degradation after exposure to the space 
vacuum environment for 338 days. Data is presented in Section 5*0 for 
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each axis and includes both ground and operating time. It is of interest 
to note that ground test time of flight components exceeded flight operating 
time by three orders of magnitude for the first and second flight space- 
craft. The significantly higher ground test time on the first two space- 
craft is attributed to special tests conducted because of earlier component 
and subsystem development problems, learning how by test personnel, and the 
refinement of test procedures. 

8.5.4 CONCLUSIONS AND RECOMMENDATIONS 

The conclusions reached from the study of the thrust vector actuator design 
are as follows: 

1) The hermetically sealed electromechanical servo actuator design 
was adequate for this application. 

2) The mechanical design of the actuator was far superior to the 
electronic design. 

3) The short time period for the design, fabrication, and delivery 
of the first article contributed to the problems which had to 
be solved later. 

Recommendations for "doing differently if one had it to do over" are: 

1) The requirement for irreversibility during the boost vibration 
was unnecessary. This design would have been adequate with a 
smaller motor if a more efficient jacks crew had been used. At 
most the real requirement was to hold position from one burn to 
the next to avoid large start up transients. 

2) The decision to use the gimbaled engine should have been made 
four months sooner. This would have provided time enough to 
work out development problems. 

3) The initial transient conditions set the actuator rate require- 
ments. Less severe conditions should have been specified for 
this design. 

4 ) The components should have been tested with the correct electrical 
loading impedances before subsystem level tests were reached. 

A portion of the subsystem electrical noise problems could have 
been avoided. 

5) Electrical noise on the signal lines should have been specified 
to the actuator vendor. This would have forced a more thorough 
analysis of the electronic design. 
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